Add ProtectHome=true

3 years ago · 2af73881d7
parent 82f82d438c
commit 2af73881d7
1 changed files with 1 additions and 0 deletions
--- a/systemd/step-ca.service
+++ b/systemd/step-ca.service
@ -31,6 +31,7 @@ NoNewPrivileges=yes

 ; Sandboxing
 ProtectSystem=full
+ProtectHome=true
 RestrictNamespaces=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 PrivateTmp=true