Archives/wg-netns
2
0
Fork 0
mirror of https://github.com/dadevel/wg-netns synced 2024-10-30 21:20:12 +00:00
Code Issues Projects Releases Wiki Activity

systemd: harden service

Browse Source 
Resolves #13, closes #16.
This commit is contained in:
Marek Küthe 2023-05-23 08:57:58 +02:00 committed by dadevel
parent 0896151668
commit a4c991a499
No known key found for this signature in database
GPG Key ID: 1A8A9735430193D5
1 changed files with 29 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
extras/wg-netns@.service
View File

@ -13,7 +13,35 @@ RemainAfterExit=yes
WorkingDirectory=%E/wireguard WorkingDirectory=%E/wireguard
ConfigurationDirectory=wireguard ConfigurationDirectory=wireguard
ConfigurationDirectoryMode=700 ConfigurationDirectoryMode=0700
ReadOnlyPaths=%E/wireguard
ReadWritePaths=%E/netns
CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_ADMIN
LimitNOFILE=4096
LimitNPROC=512
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateMounts=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=noaccess
ProtectSystem=strict
RemoveIPC=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=mnt net
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target