deblan-mirror/nextcloud-spreed-signaling
deblan-mirror/nextcloud-spreed-signaling
1
0
Fork 0
mirror of https://github.com/strukturag/nextcloud-spreed-signaling synced 2024-05-04 23:03:09 +02:00
Code Issues Releases Wiki Activity

Merge pull request #276 from Tachi107/systemd-hardening

Browse source 
dist: harden systemd service unit
This commit is contained in:
Joachim Bauch 2022-07-07 16:34:27 +02:00 committed by GitHub
parent d3f8876d25 15a9bea122
commit 5b3b147794
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 32 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
dist/init/systemd/signaling.service vendored
View file

@ -7,5 +7,37 @@ User=signaling
Group=signaling
Restart=on-failure
# Makes sure that /etc/signaling is owned by this service
ConfigurationDirectory=signaling
# Hardening - see systemd.exec(5)
CapabilityBoundingSet=
ExecPaths=/usr/bin/signaling /usr/lib
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoExecPaths=/
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
PrivateUsers=yes
ProcSubset=pid
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~ @privileged @resources
[Install]
WantedBy=multi-user.target