[Unit]
Description=LASA authorized host metadata analysis (root)
After=local-fs.target

[Service]
Type=simple
User=root
StateDirectory=lasa-deep
StateDirectoryMode=0700
ExecStart=/usr/local/bin/lasa daemon --state-dir /var/lib/lasa-deep --profile deep --interval 15m --retention 96
Restart=on-failure
RestartSec=10s
TimeoutStopSec=45s
NoNewPrivileges=yes
ProtectSystem=no
ProtectHome=no
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
LockPersonality=yes
RestrictRealtime=yes
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
UMask=0077
MemoryMax=512M
TasksMax=32
LimitNOFILE=1024
# Do not add read-only binds for /usr, /etc or /home: they would alter
# permission evidence in the scanner mount namespace. Kernel-specific
# protections can still alter their own namespace view; validate coverage.
# This unit grants no BPF capability and does not support the sensor profile.

[Install]
WantedBy=multi-user.target