Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-01-24 04:30:59 -05:00
Code Issues Packages Projects Releases Wiki Activity

initial certbot-renew service hardening

Browse Source 
This doesn't switch to using a dedicated certbot user yet since the
hooks used across the services will all still need to work.
This commit is contained in:
Daniel Micay 2022-08-10 11:29:37 -04:00
parent 5bbaecfce9
commit 2a33c3b962
2 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
systemd/system/certbot-renew.service.d/local.conf
View File

@ -1,2 +1,28 @@
[Service] [Service]
CapabilityBoundingSet=
CPUSchedulingPolicy=batch
ExecStart=/usr/bin/certbot -q renew --no-random-sleep-on-renew ExecStart=/usr/bin/certbot -q renew --no-random-sleep-on-renew
LockPersonality=true
MemoryDenyWriteExecute=true
PrivateDevices=true
PrivateIPC=true
PrivateUsers=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=read-only
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/etc/letsencrypt /var/lib/letsencrypt /var/log/letsencrypt -/srv/certbot
RemoveIPC=true
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources @obsolete

4
systemd/system/certbot-renew.service.d/mail.grapheneos.org.conf Normal file
View File

@ -0,0 +1,4 @@
[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
PrivateUsers=false