2019-06-30 09:22:43 -04:00
|
|
|
## Copyright (C) 2012 - 2018 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
|
|
|
|
## See the file COPYING for copying conditions.
|
|
|
|
|
|
2019-06-29 18:27:24 -04:00
|
|
|
[Unit]
|
|
|
|
|
Description=Mounts /proc with hidepid=2
|
2019-06-29 18:28:41 -04:00
|
|
|
Documentation=https://github.com/Whonix/security-misc
|
2019-06-29 18:27:24 -04:00
|
|
|
Requires=local-fs.target
|
|
|
|
|
After=local-fs.target
|
|
|
|
|
|
|
|
|
|
[Service]
|
|
|
|
|
Type=oneshot
|
|
|
|
|
ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
|
|
|
|
|
ProtectSystem=strict
|
|
|
|
|
ProtectHome=true
|
|
|
|
|
ProtectKernelTunables=true
|
|
|
|
|
ProtectKernelModules=true
|
|
|
|
|
ProtectControlGroups=true
|
|
|
|
|
PrivateTmp=true
|
|
|
|
|
PrivateMounts=true
|
|
|
|
|
PrivateDevices=true
|
|
|
|
|
PrivateNetwork=true
|
|
|
|
|
MemoryDenyWriteExecute=true
|
|
|
|
|
NoNewPrivileges=true
|
|
|
|
|
RestrictRealtime=true
|
|
|
|
|
SystemCallArchitectures=native
|
|
|
|
|
RestrictNamespaces=true
|
2019-07-01 03:07:14 -04:00
|
|
|
SystemCallFilter=mount munmap access read open close stat fstat lstat mmap mprotect brk rt_sigaction rt_sigprocmask execve readlink getrlimit getuid getgid geteuid getegid statfs prctl arch_prctl set_tid_address newfstatat set_robust_list openat mkdir
|
2019-06-29 18:27:24 -04:00
|
|
|
|
|
|
|
|
[Install]
|
|
|
|
|
WantedBy=multi-user.target
|
