ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: lib / systemd / system

[Unit]
Description=Imunify360 resident
Before=cagefs.service
After=network.target iptables.service firewalld.service systemd-modules-load.service
Wants=ossec-hids.service imunify360-php-daemon.service imunify-realtime-av.service imunify-notifier.socket
# Service will NOT start if this file exists
ConditionPathExists=!/var/lib/rpm-state/imunify360-transaction-in-progress

[Service]
CPUAccounting=true
MemoryAccounting=true
BlockIOAccounting=true
Slice=Imunify-agent.slice
Environment=PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=upb
Environment=LANG=en_US.UTF-8
Environment=LC_ALL=en_US.UTF-8
Environment=PYTHONNOUSERSITE=1
Environment=IMUNIFY360_LOGGING_PREFIX=r.
Environment=SQLITE_TMPDIR=/var/imunify360/tmp
Environment=FGW_FS_BASE_DIR=/var/imunify360/gw.dir
Environment=FGW_FS_MAX_CONCURRENT_QUEUES=100
# NATS embedded server for cross-component messaging (DEF-39879)
Environment=I360_NATS_ENABLED=true
Environment=I360_NATS_STORE_DIR=/var/imunify360/nats
Environment=I360_NATS_PORT=44222
Environment=I360_NATS_TOKEN_PATH=/var/run/imunify360/nats.token
# Manage /var/run/imunify360/ manually instead of using systemd's RuntimeDirectory=.
# RuntimeDirectoryPreserve=yes was added in systemd v235 and is silently ignored on
# systemd v219 (CloudLinux 7); without preserve, RuntimeDirectory= would delete the
# directory on service stop, wiping wafd_imunify_daemon's libiplists-daemon.sock and
# breaking webshield until wafd is manually restarted (DEF-41462).
Type=notify
ExecStartPre=/bin/mkdir -p /var/run/imunify360
ExecStartPre=/bin/chmod 0755 /var/run/imunify360
ExecStartPre=/usr/share/imunify360/scripts/set-service-resources.sh imunify360.service 50 50
ExecStart=/usr/bin/imunify-service
ExecStartPost=/bin/bash -c "echo $MAINPID > /var/run/imunify360.pid"
ExecStartPost=/bin/systemctl restart imunify360-resource-unlock@imunify360.timer
PIDFile=/var/run/imunify360.pid
#TODO: must be not less than defence360agent/cli/server.py:stop(seconds=8)
TimeoutStartSec=900
TimeoutStopSec=60
Restart=on-failure
RestartSec=5
StartLimitInterval=600s
StartLimitBurst=5
# Don't send SIGTERM on service stop to remaining processes in cgroup
# (SIGKILL on timeout is still sent)
KillMode=mixed
NoNewPrivileges=true
CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_KILL CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYS_RESOURCE
# AmbientCapabilities= covers caps subprocesses need as effective.
# NoNewPrivileges=true disables the kernel's "raise effective from
# permitted on UID-0 exec" path, so without Ambient children run with
# effective=empty and fail with EPERM. Why each non-obvious cap is here:
#   - CAP_NET_RAW: iptables-1.8.5's xt_set extension opens
#     AF_INET SOCK_RAW IPPROTO_RAW (libxt_set.c:get_version) to probe
#     ipset; EPERM here is reported as "Can't open socket to ipset".
#   - CAP_BPF / CAP_PERFMON / CAP_SYS_ADMIN: the agent's Go firewall
#     stack creates a BPF map (nats_port) via bpf(BPF_MAP_CREATE);
#     fails with "operation not permitted" without these.
#   - CAP_SYS_RESOURCE: cagefsctl opens /proc/lve/list to probe the
#     CloudLinux LVE kernel module before any other operation; the
#     LVE handler gates that open on CAP_SYS_RESOURCE, and EPERM
#     there is reported as "Error: current running kernel is NOT
#     supported" (misleading — the kernel IS supported, the caller
#     just lacks the cap). Verified by strace + bisect on CL9 + CSF.
#   - The rest are baseline daemon caps: CHOWN/FOWNER/SETUID/SETGID for
#     managing per-user file ownership during malware fixes;
#     DAC_OVERRIDE / DAC_READ_SEARCH for traversing system dirs;
#     SYS_PTRACE for the agent's own diagnostic helpers.
# ProtectSystem=true keeps /usr, /boot, /efi read-only. We previously
# tried =full (which also locks /etc) but every concrete failure in
# this MR's review came from panel-provided tools that the agent
# invokes as subprocesses (whmapi, custombuild, server_pref,
# rebuildhttpdconf, ie_config, cagefsctl, …) needing to write
# somewhere under /etc/. The allowlist for those grew to ~20 entries
# and was still racy on fresh installs (companion packages create
# their /etc/ dirs after the unit starts; `-` prefix entries are
# evaluated at start time and silently skipped). =true gets us out
# of the wack-a-mole and still delivers the MR's stated security
# goal — preventing privilege escalation — via NoNewPrivileges=true
# and CapabilityBoundingSet=. The /etc/* ReadWritePaths= entries
# below are now redundant under =true; kept for documentation and
# resilience if =true is ever reverted to =full.
ProtectSystem=false
# ReadWritePaths=/etc/sysconfig/imunify360
# ReadWritePaths=/etc/imunify360
# ReadWritePaths=/etc/imunify-agent-proxy
# ReadWritePaths=/etc/cron.d
# Optional ('-' prefix): wafd/webshield ship in companion packages and
# may not be present at service start (e.g. fresh install); panel
# integration dirs only exist on specific distros.
# ReadWritePaths=-/etc/imunify360-wafd
# ReadWritePaths=-/etc/imunify360-webshield
# ReadWritePaths=-/etc/csf
# ReadWritePaths=-/etc/httpd/conf.d
# ReadWritePaths=-/etc/httpd/conf/plesk.conf.d
# ReadWritePaths=-/etc/httpd/conf/extra
# ReadWritePaths=-/etc/apache2/conf.d
# ReadWritePaths=-/etc/apache2/conf-enabled
# ReadWritePaths=-/etc/apache2/plesk.conf.d
# ReadWritePaths=-/etc/modsecurity.d
# ReadWritePaths=-/etc/yum.repos.d
# ReadWritePaths=-/etc/apt/sources.list.d
# Additional dirs the agent rewrites at runtime, surfaced by build 523:
# - /usr/share/i360-php-opts: proactive-defense PHP-immunity DB
#   (im360/subsys/proactive.py + i360-storage-replacehdb-v2 helper).
# - /etc/httpd/conf/modsecurity.d: Plesk modsec rules (RBL whitelist,
#   malware-list .tmp tempfiles); sibling of plesk.conf.d, not a child.
# - /usr/local/directadmin: DA modsec includes and per-user domain
#   files rewritten on each sync.
# ReadWritePaths=-/usr/share/i360-php-opts
# ReadWritePaths=-/etc/httpd/conf/modsecurity.d
# ReadWritePaths=-/usr/local/directadmin
# Additional cPanel + CageFS dirs surfaced by build 535:
# - /usr/local/cpanel: where the cPanel hook installer drops
#   ImunifyHook.pm.
# - /etc/cagefs, /var/cagefs, /usr/share/cagefs, /usr/share/cagefs-skeleton:
#   rewritten by `cagefsctl --force-update-etc` which the agent's cagefs plugin
#   spawns; without these the subprocess hangs and the agent's
#   asyncio cancel surfaces as cascading test setup failures.
#   /usr/share/cagefs-skeleton is a SEPARATE top-level dir (not under
#   /usr/share/cagefs); cagefsctl's check_skeleton() does os.chmod() on it,
#   which raises EROFS under ProtectSystem=. On a CageFS host the resulting
#   cagefsctl failure makes migration 129_fixed_cagefs_unmount fall back to a
#   synchronous `systemctl restart cagefs`, which deadlocks against
#   Before=cagefs.service and hangs agent startup (DEF-47738).
# ReadWritePaths=-/usr/local/cpanel
# ReadWritePaths=-/etc/cagefs
# ReadWritePaths=-/var/cagefs
# ReadWritePaths=-/usr/share/cagefs
# ReadWritePaths=-/usr/share/cagefs-skeleton
# Plesk plugin scripts dir (build 550): the agent installs/updates
# /usr/local/psa/admin/plib/modules/imunify360/scripts/ on hooks.
# ReadWritePaths=-/usr/local/psa/admin/plib/modules/imunify360
# Plesk runtime state — notification log written by send-notifications.php
# (/usr/local/psa/var/modules/imunify360/imunify360-local.log) and the
# plesk-sendmail spool/tempfile dir. ProtectSystem=true bind-mounts /usr
# read-only and CAP_DAC_OVERRIDE cannot bypass a mount-layer RO, so the
# Plesk notification hook fails with EACCES without this entry.
# ReadWritePaths=-/usr/local/psa/var
# Webuzo keeps Apache (and the modsec audit log) under /usr/local/apps;
# the resident-agent's modsec sensor tails that log and persists its read
# position to a <auditlog>.filetail.state file beside it. ProtectSystem=true
# bind-mounts /usr read-only, so without this the state write fails with EROFS.
# ReadWritePaths=-/usr/local/apps
# LiteSpeed keeps its config tree under /usr/local/lsws, including the
# per-domain <domain>.d/modsec.conf files rewritten by the agent's
# integration.sh rewrite-domain-configs. ProtectSystem=true makes /usr
# read-only, so without this carve-out the per-domain modsec rewrite fails
# with EROFS.
# ReadWritePaths=-/usr/local/lsws
# CSF installs its post-hook script as /usr/local/csf/bin/csfpost.sh (preferred
# over /etc/csf/csfpost.sh when present); the ExportWBList plugin rewrites it
# on activation. ProtectSystem=true makes /usr read-only, so without this
# carve-out the rewrite fails with EROFS.
# ReadWritePaths=-/usr/local/csf
# PrivateTmp= deliberately not set. Tried =yes in v9.x and reverted:
# the agent and several subsystems share /tmp with co-resident
# processes — pytest fixtures touch /tmp/sample_enabled to enable
# the Sample backup backend (rpm-tests/utils/backups.py), and the
# realtime inotify malware scanner watches user-controlled paths
# including /tmp on production hosts (PHP session/upload files).
# A private /tmp namespace silently hides both. The security goal
# of preventing /tmp data leaks is mostly carried by ProtectSystem=
# and NoNewPrivileges= already.

[Install]
WantedBy=multi-user.target

[+] ..
[+] runlevel2.target.wants
[-] emergency.target [edit]
[-] imunify-auditd-log-reader.service [edit]
[-] rdisc.service [edit]
[-] runlevel2.target [edit]
[-] imunify360-agent.socket [edit]
[-] lshttpd.service [edit]
[-] reboot.target [edit]
[-] cxswatch.service [edit]
[-] var-lve-dbgovernor\x2dshm.mount [edit]
[-] sigpwr.target [edit]
[-] nfs-lock.service [edit]
[-] initrd-cleanup.service [edit]
[-] sw-engine.service [edit]
[-] crond.service [edit]
[-] systemd-reboot.service [edit]
[-] systemd-user-sessions.service [edit]
[-] snmptrapd.service [edit]
[-] systemd-readahead-done.timer [edit]
[-] [email protected] [edit]
[+] default.target.wants
[-] brandbot.path [edit]
[-] gssproxy.service [edit]
[-] fstrim.timer [edit]
[-] systemd-readahead-done.service [edit]
[+] sockets.target.wants
[-] redis-sentinel.service [edit]
[-] proc-fs-nfsd.mount [edit]
[-] default.target [edit]
[-] tuned.service [edit]
[-] blk-availability.service [edit]
[-] irqbalance.service [edit]
[+] poweroff.target.wants
[-] ctrl-alt-del.target [edit]
[-] lsapi-cache.service [edit]
[-] systemd-udev-trigger.service [edit]
[-] systemd-udevd-control.socket [edit]
[-] kcare.service [edit]
[-] rhel-loadmodules.service [edit]
[-] rsyncd.service [edit]
[-] rsyslog.service [edit]
[-] systemd-localed.service [edit]
[-] systemd-quotacheck.service [edit]
[-] hibernate.target [edit]
[-] kmod-static-nodes.service [edit]
[-] dbus.service [edit]
[-] systemd-hibernate.service [edit]
[-] systemd-ask-password-plymouth.path [edit]
[-] rpcbind.socket [edit]
[-] sshd.service [edit]
[-] dracut-initqueue.service [edit]
[-] imunify360-webshield-ssl-cache.service [edit]
[-] nfs.service [edit]
[-] nfs-server.service [edit]
[-] redis.service [edit]
[-] governor_sentry_daemon.service [edit]
[-] dracut-mount.service [edit]
[+] runlevel5.target.wants
[-] lve_namespaces.service [edit]
[-] paths.target [edit]
[-] dracut-pre-trigger.service [edit]
[-] plymouth-reboot.service [edit]
[-] aibolit-resident.socket [edit]
[-] systemd-suspend.service [edit]
[-] mysqld.service [edit]
[-] imunify360-php-daemon.socket [edit]
[-] systemd-ask-password-wall.service [edit]
[-] var-lib-nfs-rpc_pipefs.mount [edit]
[+] runlevel3.target.wants
[-] systemd-sysctl.service [edit]
[-] systemd-udevd.service [edit]
[-] lsws.service [edit]
[-] [email protected] [edit]
[-] [email protected] [edit]
[-] kernel-triggers.service [edit]
[-] runlevel6.target [edit]
[-] dracut-cmdline.service [edit]
[-] sshd-keygen.service [edit]
[-] system.slice [edit]
[-] libcare.socket [edit]
[-] lvectl.service [edit]
[-] systemd-udev-settle.service [edit]
[-] osmd.service [edit]
[-] rpcgssd.service [edit]
[-] nscd.socket [edit]
[-] kexec.target [edit]
[-] dbus-org.freedesktop.locale1.service [edit]
[-] swap.target [edit]
[-] remote-cryptsetup.target [edit]
[-] initrd-udevadm-cleanup-db.service [edit]
[-] [email protected] [edit]
[-] runlevel1.target [edit]
[-] plymouth-read-write.service [edit]
[-] initrd.target [edit]
[-] sound.target [edit]
[-] httpd.service.ls_bak_bak [edit]
[-] httpd.service [edit]
[+] syslog.target.wants
[-] dev-hugepages.mount [edit]
[-] rpcbind.target [edit]
[+] initrd.target.wants
[-] nfs-rquotad.service [edit]
[-] lve.service [edit]
[-] systemd-ask-password-plymouth.service [edit]
[-] microcode.service [edit]
[-] rhel-configure.service [edit]
[-] imunify360-webshield.service [edit]
[-] poweroff.target [edit]
[-] sys-kernel-config.mount [edit]
[-] imunify-agent-proxy.service [edit]
[-] imunify-antivirus-sensor.socket [edit]
[-] ea-php81-php-fpm.service [edit]
[-] imunify-notifier.socket [edit]
[-] proc-sys-fs-binfmt_misc.automount [edit]
[-] systemd-initctl.service [edit]
[-] messagebus.service [edit]
[-] system-update.target [edit]
[-] qemu-guest-agent.service [edit]
[-] libcare-autostart.service [edit]
[+] sw-engine.service.d
[-] rhel-readonly.service [edit]
[-] runlevel5.target [edit]
[-] systemd-importd.service [edit]
[-] dbus-org.freedesktop.login1.service [edit]
[-] jetindexd.service [edit]
[-] local-fs.target [edit]
[+] runlevel4.target.wants
[-] [email protected] [edit]
[-] plymouth-halt.service [edit]
[-] lvemanager.service [edit]
[-] smartd.service [edit]
[-] ossec-hids.service [edit]
[-] imunify360-dos-protection.service [edit]
[-] systemd-remount-fs.service [edit]
[-] cryptsetup-pre.target [edit]
[-] imunify360-scanlogd.service [edit]
[-] brandbot.service [edit]
[-] dbus-org.freedesktop.hostname1.service [edit]
[-] systemd-ask-password-console.service [edit]
[-] auth-rpcgss-module.service [edit]
[-] systemd-journal-flush.service [edit]
[-] bluetooth.target [edit]
[-] imunify-notifier.service [edit]
[-] network-pre.target [edit]
[-] systemd-update-done.service [edit]
[-] rpc-statd.service [edit]
[-] rhel-domainname.service [edit]
[-] getty.target [edit]
[-] imunify360-pam.service [edit]
[-] imunify-agent-proxy.socket [edit]
[-] sshd.socket [edit]
[-] systemd-tmpfiles-clean.timer [edit]
[+] halt.target.wants
[-] rpcidmapd.service [edit]
[-] [email protected] [edit]
[-] machine.slice [edit]
[-] systemd-ask-password-wall.path [edit]
[-] ea-php74-php-fpm.service [edit]
[-] slices.target [edit]
[-] rpcbind.service [edit]
[+] sysinit.target.wants
[-] runlevel0.target [edit]
[-] systemd-update-utmp-runlevel.service [edit]
[-] network.target [edit]
[-] tmp.mount [edit]
[-] iprdump.service [edit]
[-] imunify360.service [edit]
[-] plymouth-quit.service [edit]
[-] auditd.service [edit]
[-] rhel-import-state.service [edit]
[-] nfs-client.target [edit]
[-] kdump.service [edit]
[-] initrd-switch-root.target [edit]
[-] dracut-pre-mount.service [edit]
[-] pdns.service [edit]
[-] rescue.service [edit]
[-] imunify360-unified-access-logger.service [edit]
[-] ssa-agent.socket [edit]
[-] criu.socket [edit]
[-] jetmongod.service [edit]
[-] console-shell.service [edit]
[-] criu.service [edit]
[-] nfs-mountd.service [edit]
[-] proc-sys-fs-binfmt_misc.mount [edit]
[-] rhel-autorelabel.service [edit]
[-] systemd-hostnamed.service [edit]
[-] systemd-bootchart.service [edit]
[-] nfs-config.service [edit]
[-] [email protected] [edit]
[-] wpa_supplicant.service [edit]
[-] user.slice [edit]
[-] snmpd.service [edit]
[-] rpc-rquotad.service [edit]
[-] emergency.service [edit]
[-] systemd-hwdb-update.service [edit]
[+] systemd-logind.service.d
[-] ea-php72-php-fpm.service [edit]
[-] imunify360-agent.service [edit]
[+] timers.target.wants
[-] printer.target [edit]
[-] imunify360-pam.socket [edit]
[-] dracut-pre-udev.service [edit]
[-] iprinit.service [edit]
[-] iprutils.target [edit]
[-] nss-user-lookup.target [edit]
[-] [email protected] [edit]
[-] dracut-pre-pivot.service [edit]
[-] nscd.service [edit]
[-] network-online.target [edit]
[-] rsyncd.socket [edit]
[-] basic.target [edit]
[-] plymouth-poweroff.service [edit]
[-] plymouth-start.service [edit]
[-] systemd-update-utmp.service [edit]
[-] imunify360-php-daemon.service [edit]
[-] wp-toolkit-scheduled-tasks.service [edit]
[-] systemd-binfmt.service [edit]
[-] lvestats.service [edit]
[-] dbus-org.freedesktop.machine1.service [edit]
[-] syslog.socket [edit]
[-] systemd-journald.service [edit]
[-] jetbackup5d.service [edit]
[-] plymouth-switch-root.service [edit]
[-] polkit.service [edit]
[-] -.slice [edit]
[-] proxyexecd.service [edit]
[-] graphical.target [edit]
[-] rpc-statd-notify.service [edit]
[-] [email protected] [edit]
[-] console-getty.service [edit]
[-] quotaon.service [edit]
[-] ea-php82-php-fpm.service [edit]
[-] [email protected] [edit]
[-] ea-php83-php-fpm.service [edit]
[-] systemd-shutdownd.socket [edit]
[-] imunify-antivirus.service [edit]
[-] initrd-switch-root.service [edit]
[-] atd.service [edit]
[-] systemd-journal-catalog-update.service [edit]
[-] systemd-poweroff.service [edit]
[-] timers.target [edit]
[-] sleep.target [edit]
[-] nss-lookup.target [edit]
[-] systemd-halt.service [edit]
[-] sockets.target [edit]
[-] systemd-readahead-replay.service [edit]
[-] systemd-machined.service [edit]
[-] cagefs.service [edit]
[-] ea-php54-php-fpm.service [edit]
[-] imunify-realtime-av.service [edit]
[-] kvm_stat.service [edit]
[-] dbus.socket [edit]
[-] nfslock.service [edit]
[-] atop.service [edit]
[-] htcacheclean.service [edit]
[-] remote-fs-pre.target [edit]
[-] systemd-tmpfiles-setup-dev.service [edit]
[-] ebtables.service [edit]
[-] ssa-agent.service [edit]
[-] arp-ethers.service [edit]
[-] getty-pre.target [edit]
[-] machines.target [edit]
[-] ossec-hids-authd.service [edit]
[-] systemd-shutdownd.service [edit]
[-] initrd-fs.target [edit]
[-] systemd-timedated.service [edit]
[-] tcsd.service [edit]
[-] initrd-parse-etc.service [edit]
[-] nfs-secure.service [edit]
[-] imunify-antivirus.socket [edit]
[-] nfs-blkmap.service [edit]
[-] [email protected] [edit]
[-] halt-local.service [edit]
[-] time-sync.target [edit]
[+] multi-user.target.wants
[-] chrony-wait.service [edit]
[+] initrd-switch-root.target.wants
[-] sysstat.service [edit]
[-] systemd-random-seed.service [edit]
[-] systemd-vconsole-setup.service [edit]
[-] plymouth-quit-wait.service [edit]
[-] [email protected] [edit]
[-] local-fs-pre.target [edit]
[-] halt.target [edit]
[+] local-fs.target.wants
[-] [email protected] [edit]
[-] sys-fs-fuse-connections.mount [edit]
[-] atop-rotate.timer [edit]
[-] sysinit.target [edit]
[-] named.service [edit]
[-] systemd-journald.socket [edit]
[-] systemd-udevd-kernel.socket [edit]
[-] ea-php73-php-fpm.service [edit]
[-] [email protected] [edit]
[-] systemd-modules-load.service [edit]
[-] [email protected] [edit]
[+] kexec.target.wants
[-] imunify-antivirus-user.socket [edit]
[-] systemd-machine-id-commit.service [edit]
[-] shutdown.target [edit]
[-] multi-user.target [edit]
[-] imunify360-agent-user.socket [edit]
[-] named-setup-rndc.service [edit]
[-] initrd-root-fs.target [edit]
[-] systemd-tmpfiles-setup.service [edit]
[+] graphical.target.wants
[+] rescue.target.wants
[-] nfs-utils.service [edit]
[-] rescue.target [edit]
[-] libcare.service [edit]
[-] rhel-autorelabel-mark.service [edit]
[-] systemd-hybrid-sleep.service [edit]
[-] systemd-kexec.service [edit]
[+] dbus.target.wants
[-] systemd-firstboot.service [edit]
[-] [email protected] [edit]
[-] ossec-hids-hybrid.service [edit]
[-] umount.target [edit]
[-] systemd-tmpfiles-clean.service [edit]
[-] final.target [edit]
[-] systemd-ask-password-console.path [edit]
[-] runlevel4.target [edit]
[-] runlevel3.target [edit]
[+] reboot.target.wants
[-] httpd.service.ls_bak [edit]
[+] runlevel1.target.wants
[-] [email protected] [edit]
[-] systemd-logind.service [edit]
[+] basic.target.wants
[-] cpupower.service [edit]
[-] imunify-realtime-av-fchange-installer.service [edit]
[-] suspend.target [edit]
[-] nfs-idmapd.service [edit]
[-] nfs-idmap.service [edit]
[-] dracut-shutdown.service [edit]
[-] sys-kernel-debug.mount [edit]
[-] rhel-dmesg.service [edit]
[-] systemd-readahead-drop.service [edit]
[-] imunify360-pure.service [edit]
[-] wp-toolkit-background-tasks.service [edit]
[-] MailScanner.service [edit]
[-] hybrid-sleep.target [edit]
[-] plymouth-kexec.service [edit]
[-] dbus-org.freedesktop.import1.service [edit]
[-] cryptsetup.target [edit]
[-] debug-shell.service [edit]
[-] atopacct.service [edit]
[-] [email protected] [edit]
[-] rc-local.service [edit]
[-] systemd-fsck-root.service [edit]
[-] ea-php80-php-fpm.service [edit]
[-] rpc_pipefs.target [edit]
[-] nrpe.service [edit]
[-] smartcard.target [edit]
[-] systemd-readahead-collect.service [edit]
[-] rpc-gssd.service [edit]
[-] fstrim.service [edit]
[-] db_governor.service [edit]
[+] shutdown.target.wants
[-] ea-php56-php-fpm.service [edit]
[-] aibolit-resident.service [edit]
[-] systemd-initctl.socket [edit]
[-] imunify360-wafd.service [edit]
[-] iprupdate.service [edit]
[-] chronyd.service [edit]
[-] dbus-org.freedesktop.timedate1.service [edit]
[-] dev-mqueue.mount [edit]
[-] atop-rotate.service [edit]
[-] remote-fs.target [edit]