systemd/systemd-services: add power-profiles-daemon unit file

extra-repos/systemd/systemd-services/APKBUILD

@@ -7,7 +7,7 @@
 # How to add a new service file (5 steps):
 pkgname=systemd-services
 # 1. bump pkgver
-pkgver=53
+pkgver=54
 pkgrel=0
 pkgdesc="Systemd service files"
 url="https://postmarketos.org"
@@ -53,6 +53,7 @@ subpackages="
 	openssh-server-pam-systemd:_service
 	pd-mapper-systemd:_service
 	plasma-mobile-systemd:_service
+	power-profiles-daemon-systemd:_service
 	powerdevil-systemd:_service
 	q6voiced-systemd:_service
 	qbootctl-systemd:_service
@@ -139,6 +140,7 @@ _nftables_sources="system/nftables.service"
 _openssh_server_pam_sources="system/sshd.service system/sshdgenkeys.service"
 _pd_mapper_sources="system/pd-mapper.service"
 _plasma_mobile_sources="system/plasma-mobile.service"
+_power_profiles_daemon_sources="system/power-profiles-daemon.service" # From https://gitlab.freedesktop.org/upower/power-profiles-daemon/-/blob/main/data/power-profiles-daemon.service.in
 _powerdevil_sources="user/plasma-powerdevil.service" # From https://invent.kde.org/plasma/powerdevil/-/blob/master/daemon/plasma-powerdevil.service.in
 _q6voiced_sources="system/q6voiced.service"
 _qbootctl_sources="system/qbootctl.service"
@@ -213,6 +215,7 @@ source="$(flatpath \
 	$_openssh_server_pam_sources \
 	$_pd_mapper_sources \
 	$_plasma_mobile_sources \
+	$_power_profiles_daemon_sources \
 	$_powerdevil_sources \
 	$_q6voiced_sources \
 	$_qbootctl_sources \
@@ -378,6 +381,7 @@ fa445c4a53214524baed4e9c52a5463592a074f88a5a286eacb60d0907c0545f725afde23abd68cf
 c0badea3905c1d53d213fbfe11d25b556a2e484fe77eb50e9f4d42e25b67b56a0804e7d8e1b7731cd280cbb3525b4c60311817609381e2308d9f2dfb7c0d7072  system-sshdgenkeys.service
 0bed9a8a719661609ad84d1c6fcdf2fe9213e741682b7ddebad82d9744f137c593788ed522868f10b95b599d81743d07ec3212630a7e99d333261dfa1bf1cc11  system-pd-mapper.service
 e12d8e98e28a795f879aebcceb32a991ee4abcb3bc5ec458aa5378bb52ff86cf39be04bc4a196925f532d623304b3005f561fa5e55d1c87944d718058ec4c0e6  system-plasma-mobile.service
+95a6acdc58b2ca13a92c62a36e455da9007443798c48a614a2154669de9a73e176b2f92124716f919f0088ba5b5bc4ae679138babf2c41f6e02c6a26af2da46a  system-power-profiles-daemon.service
 291ac8b09e4904da016727bcf6b08e4f371f84ad46d181c74e7e5b319b73e72500989f9fb964617f84babdec4a91307f8295b008e4c44a0e6eecb6e7bf699aa0  user-plasma-powerdevil.service
 4c4c3f1e5e829ff67dd35df59120ab59730ff1f1ca0aab93f16d670132979a99099fad59e6c736908cc19df9172c9bdfe476ec721a1cc28de8c2210da46ce1f1  system-q6voiced.service
 621189aa251655796795f4fa0cd79360bb67573e7327e545064eaadafc83cc7b382a405d6ba80662e0a4ece3876e4270e3563d859a6ba63b5e3854b39c35873e  system-qbootctl.service

extra-repos/systemd/systemd-services/system-power-profiles-daemon.service

+[Unit]
+Description=Power Profiles daemon
+Conflicts=tuned.service tlp.service auto-cpufreq.service system76-power.service
+After=multi-user.target display-manager.target
+
+[Service]
+Type=dbus
+BusName=org.freedesktop.UPower.PowerProfiles
+# To enable debugging add a -vv to the ExecStart line
+ExecStart=/usr/libexec/power-profiles-daemon
+Restart=on-failure
+# This always corresponds to /var/lib/power-profiles-daemon
+StateDirectory=power-profiles-daemon
+
+# Lockdown
+CapabilityBoundingSet=CAP_SYS_ADMIN
+DevicePolicy=closed
+IPAddressDeny=any
+KeyringMode=private
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateTmp=yes
+PrivateNetwork=yes
+PrivateUsers=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectProc=invisible
+ProtectSystem=strict
+RemoveIPC=yes
+RestrictAddressFamilies=AF_UNIX AF_LOCAL AF_NETLINK
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallFilter=@system-service
+SystemCallFilter=~@resources @privileged
+SystemCallErrorNumber=EPERM
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=graphical.target
+