systemd hardening for pvv-nettsiden-gallery-update.service (!90)
#133 Reviewed-on: #90 Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Co-authored-by: Alf Helge Jakobsen <alfhj@stud.ntnu.no> Co-committed-by: Alf Helge Jakobsen <alfhj@stud.ntnu.no>
This commit is contained in:
parent
464576e856
commit
b07cd5fbf6
|
@ -62,6 +62,33 @@ in {
|
||||||
WorkingDirectory = galleryDir;
|
WorkingDirectory = galleryDir;
|
||||||
User = config.services.pvv-nettsiden.user;
|
User = config.services.pvv-nettsiden.user;
|
||||||
Group = config.services.pvv-nettsiden.group;
|
Group = config.services.pvv-nettsiden.group;
|
||||||
|
|
||||||
|
AmbientCapabilities = [ "" ];
|
||||||
|
CapabilityBoundingSet = [ "" ];
|
||||||
|
DeviceAllow = [ "" ];
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
NoNewPrivileges = true; # disable for third party rotate scripts
|
||||||
|
PrivateDevices = true;
|
||||||
|
PrivateNetwork = true; # disable for mail delivery
|
||||||
|
PrivateTmp = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
ProtectHome = true; # disable for userdir logs
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectProc = "invisible";
|
||||||
|
ProtectSystem = "full";
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
RestrictSUIDSGID = true; # disable for creating setgid directories
|
||||||
|
SocketBindDeny = [ "any" ];
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = [
|
||||||
|
"@system-service"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue