graphene-os-server-infrastr.../systemd/system/nginx.service.d/local.conf

[Service]
CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID
LockPersonality=true
NoNewPrivileges=true
MemoryDenyWriteExecute=true
PrivateIPC=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/var/lib/nginx /var/log/nginx -/var/cache/nginx
Restart=always
RestartSec=1
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
RuntimeDirectory=nginx
RuntimeDirectoryMode=700
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@obsolete
extend nginx service hardening 2022-08-09 08:43:51 +00:00			`[Service]`
allow nginx master process to use CAP_CHOWN This is required for it to create the /var directories it uses when the master process is running as root. It would be possible to run the nginx master process as non-root but it doesn't drop ambient capabilities when it spawns the workers so running the master process as non-root will end up giving the workers higher privileges due to them ending up getting the CAP_NET_BIND_SERVICE capability passed through. 2023-07-06 08:57:45 +00:00			`CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID`
extend nginx service hardening 2022-08-09 08:43:51 +00:00			`LockPersonality=true`
			`NoNewPrivileges=true`
			`MemoryDenyWriteExecute=true`
			`PrivateIPC=true`
			`PrivateTmp=true`
			`ProcSubset=pid`
			`ProtectClock=true`
			`ProtectControlGroups=true`
sort nginx hardening.conf options 2022-08-10 12:27:43 +00:00			`ProtectHome=true`
			`ProtectHostname=true`
extend nginx service hardening 2022-08-09 08:43:51 +00:00			`ProtectKernelLogs=true`
			`ProtectKernelModules=true`
			`ProtectKernelTunables=true`
			`ProtectProc=invisible`
			`ProtectSystem=strict`
			`ReadWritePaths=/var/lib/nginx /var/log/nginx -/var/cache/nginx`
auto-restart nginx if master process is killed nginx handles restarting workers automatically but the master process is typically killed by the OOM killer too. 2022-09-26 20:03:12 +00:00			`Restart=always`
			`RestartSec=1`
extend nginx service hardening 2022-08-09 08:43:51 +00:00			`RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX`
			`RestrictNamespaces=true`
			`RestrictRealtime=true`
			`RestrictSUIDSGID=true`
replace tmpfiles.d with RuntimeDirectory for nginx This is much more robust because nginx will fail to start after being killed or crashing due to only removing old Unix domain sockets when it stops cleanly. It ends up owned by root:root instead of root:http which is fine because only the master process opens it. 2022-09-26 19:37:43 +00:00			`RuntimeDirectory=nginx`
			`RuntimeDirectoryMode=700`
extend nginx service hardening 2022-08-09 08:43:51 +00:00			`SystemCallArchitectures=native`
			`SystemCallFilter=@system-service`
			`SystemCallFilter=~@obsolete`