[Unit]
Description=Apply the lve-ipc-isolation feature flag to kernel.lve_ipc_isolation
# The sysctl exists once kmod-lve is loaded, and it applies to LVEs created
# after it changes - so it has to be in place before every unit that creates
# them at boot: the same set lve.service orders itself before, starting with
# lve_namespaces.service (lvectl start). lve.service also re-applies the
# persisted value right after modprobe; this run covers a flag that changed
# while the server was down.
After=lve.service
Before=lve_namespaces.service lvectl.service cagefs.service proxyexecd.service lvestats.service db_governor.service httpd.service sshd.service crond.service mysql.service mysqld.service mariadb.service

[Service]
Type=oneshot
ExecStart=/usr/share/cloudlinux/lve-ipc-isolation
SyslogIdentifier=lve-ipc-isolation
# Several flag changes in a row must not trip systemd's start rate limit: a
# path unit whose service hits it stops watching for good. Spelled the way
# systemd 219 (CL7) understands it; newer versions accept it as the alias of
# StartLimitIntervalSec= in [Unit].
StartLimitInterval=0

[Install]
WantedBy=multi-user.target