oysteikt
/
mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

systemd: more paranoid security settings

This commit is contained in:
Max Kellermann 2016-12-09 10:36:02 +01:00
parent 54d5d9d1cc
commit e3237f057d
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -6,6 +6,7 @@ ver 0.19.20 (not yet released)
* output * output
- winmm: fix 8 bit playback - winmm: fix 8 bit playback
* fix gcc 7.0 -Wimplicit-fallthrough * fix gcc 7.0 -Wimplicit-fallthrough
* systemd: paranoid security settings
ver 0.19.19 (2016/08/23) ver 0.19.19 (2016/08/23)
* decoder * decoder

9
systemd/mpd.service.in
View File

@ -12,6 +12,15 @@ LimitRTTIME=infinity
# disallow writing to /usr, /bin, /sbin, ... # disallow writing to /usr, /bin, /sbin, ...
ProtectSystem=yes ProtectSystem=yes
# more paranoid security settings
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
RestrictNamespaces=yes
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target
Also=mpd.socket Also=mpd.socket