mirror of
https://gitlab.com/veilid/veilid.git
synced 2024-10-01 01:26:08 -04:00
Merge branch 'systemd-hardening' into 'main'
Some light hardening of veilid-server standalone node via systemd See merge request veilid/veilid!187
This commit is contained in:
commit
d74dad3ec9
@ -8,14 +8,36 @@ After=network-online.target
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment=RUST_BACKTRACE=1
|
||||
ExecStart=/usr/bin/veilid-server
|
||||
ExecStart=/usr/bin/veilid-server -c /etc/veilid-server/veilid-server.conf
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
KillSignal=SIGQUIT
|
||||
TimeoutStopSec=5
|
||||
PrivateTmp=true
|
||||
WorkingDirectory=/
|
||||
User=veilid
|
||||
Group=veilid
|
||||
|
||||
CapabilityBoundingSet=
|
||||
SystemCallFilter=@system-service
|
||||
MemoryDenyWriteExecute=true
|
||||
NoNewPrivileges=true
|
||||
PrivateDevices=true
|
||||
PrivateTmp=true
|
||||
PrivateUsers=true
|
||||
ProtectHome=true
|
||||
ProtectClock=true
|
||||
ProtectControlGroups=true
|
||||
ProtectKernelLogs=true
|
||||
ProtectKernelModules=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectProc=invisible
|
||||
ProtectSystem=strict
|
||||
ReadWritePaths=/var/db/veilid-server
|
||||
ConfigurationDirectory=veilid-server
|
||||
|
||||
RestrictRealtime=true
|
||||
SystemCallArchitectures=native
|
||||
LockPersonality=true
|
||||
RestrictSUIDSGID=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
WantedBy=multi-user.target
|
||||
|
Loading…
Reference in New Issue
Block a user