Matrix-Mirrors/matrix.grapheneos.org
1
0
Fork 0
mirror of https://github.com/GrapheneOS/matrix.grapheneos.org.git synced 2024-10-01 04:45:34 -04:00
Code Issues Packages Projects Releases Wiki Activity

add initial hardening to remote backup service

Browse Source
This commit is contained in:
Daniel Micay 2022-08-11 13:37:29 -04:00
parent db209e53b4
commit ff010aa945
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
systemd/system/remote-backup.service
View File

@ -2,8 +2,34 @@
Description=Perform remote backup Description=Perform remote backup
[Service] [Service]
CapabilityBoundingSet=
CPUSchedulingPolicy=batch CPUSchedulingPolicy=batch
ExecStart=/usr/local/bin/remote-backup ExecStart=/usr/local/bin/remote-backup
LockPersonality=true
NoNewPrivileges=true
MemoryDenyWriteExecute=true
PrivateDevices=true
PrivateIPC=true
PrivateTmp=true
PrivateUsers=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@resources @obsolete
Type=oneshot Type=oneshot
UMask=0077
User=root User=root
WorkingDirectory=/root WorkingDirectory=/root