Qubes-VM-hardening/vm-boot-protect.service

[Unit]
Description=Protect Qubes VM execution environment at startup
Documentation=https://github.com/tasket/Qubes-VM-hardening
After=qubes-sysinit.service
Before=qubes-mount-dirs.service
DefaultDependencies=false
#OnFailure=rescue.target
#OnFailureJobMode=replace-irreversibly

[Service]
Type=oneshot
RemainAfterExit=no
# privdirs must begin with /rw
# Environment="privdirs=/rw/config /rw/usrlocal /rw/bind-dirs"
ExecStart=/usr/lib/qubes/init/vm-boot-protect.sh
Restart=no

[Install]
WantedBy=sysinit.target
Create vm-sudo-protect.service 2017-04-17 14:21:07 -04:00			`[Unit]`
Service rename to vm-boot-protect 2018-03-29 02:57:06 -04:00			`Description=Protect Qubes VM execution environment at startup`
Misc fixes, additions Fix rescue mode, deployment. Add whitelist and sudo config. 2018-04-12 15:24:46 -04:00			`Documentation=https://github.com/tasket/Qubes-VM-hardening`
Update vm-sudo-protect.service Should allow service to run without interference. Now supported as Qubes service `vm-sudo-protect`. 2017-04-20 19:20:25 -04:00			`After=qubes-sysinit.service`
Add parameters for Whonix Tested briefly on Whonix. Don't use 'vm-sudo-protect-root' service. 2017-04-21 11:26:55 -04:00			`Before=qubes-mount-dirs.service`
			`DefaultDependencies=false`
Remove shutdown.target 2018-03-29 23:52:43 -04:00			`#OnFailure=rescue.target`
			`#OnFailureJobMode=replace-irreversibly`
Create vm-sudo-protect.service 2017-04-17 14:21:07 -04:00
			`[Service]`
			`Type=oneshot`
			`RemainAfterExit=no`
Fix: Remove quotes from copy glob 2018-03-29 09:54:31 -04:00			`# privdirs must begin with /rw`
Remove shutdown.target 2018-03-29 23:52:43 -04:00			`# Environment="privdirs=/rw/config /rw/usrlocal /rw/bind-dirs"`
Service rename to vm-boot-protect 2018-03-29 02:57:06 -04:00			`ExecStart=/usr/lib/qubes/init/vm-boot-protect.sh`
Get rescue cli working 2018-04-02 10:55:55 -04:00			`Restart=no`
Create vm-sudo-protect.service 2017-04-17 14:21:07 -04:00
			`[Install]`
Update vm-sudo-protect.service Should allow service to run without interference. Now supported as Qubes service `vm-sudo-protect`. 2017-04-20 19:20:25 -04:00			`WantedBy=sysinit.target`