mirror of
https://github.com/dadevel/wg-netns
synced 2024-10-30 21:20:12 +00:00
parent
0896151668
commit
a4c991a499
@ -13,7 +13,35 @@ RemainAfterExit=yes
|
||||
|
||||
WorkingDirectory=%E/wireguard
|
||||
ConfigurationDirectory=wireguard
|
||||
ConfigurationDirectoryMode=700
|
||||
ConfigurationDirectoryMode=0700
|
||||
ReadOnlyPaths=%E/wireguard
|
||||
ReadWritePaths=%E/netns
|
||||
|
||||
CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_ADMIN
|
||||
LimitNOFILE=4096
|
||||
LimitNPROC=512
|
||||
LockPersonality=true
|
||||
MemoryDenyWriteExecute=true
|
||||
NoNewPrivileges=true
|
||||
PrivateDevices=true
|
||||
PrivateMounts=true
|
||||
PrivateTmp=true
|
||||
ProcSubset=pid
|
||||
ProtectClock=true
|
||||
ProtectControlGroups=true
|
||||
ProtectHome=true
|
||||
ProtectHostname=true
|
||||
ProtectKernelLogs=true
|
||||
ProtectKernelModules=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectProc=noaccess
|
||||
ProtectSystem=strict
|
||||
RemoveIPC=true
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK
|
||||
RestrictNamespaces=mnt net
|
||||
RestrictRealtime=true
|
||||
RestrictSUIDSGID=true
|
||||
SystemCallArchitectures=native
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
Loading…
Reference in New Issue
Block a user