2
0
mirror of https://github.com/dadevel/wg-netns synced 2024-10-30 21:20:12 +00:00

systemd: harden service

Resolves #13, closes #16.
This commit is contained in:
Marek Küthe 2023-05-23 08:57:58 +02:00 committed by dadevel
parent 0896151668
commit a4c991a499
No known key found for this signature in database
GPG Key ID: 1A8A9735430193D5

View File

@ -13,7 +13,35 @@ RemainAfterExit=yes
WorkingDirectory=%E/wireguard
ConfigurationDirectory=wireguard
ConfigurationDirectoryMode=700
ConfigurationDirectoryMode=0700
ReadOnlyPaths=%E/wireguard
ReadWritePaths=%E/netns
CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_ADMIN
LimitNOFILE=4096
LimitNPROC=512
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateMounts=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=noaccess
ProtectSystem=strict
RemoveIPC=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=mnt net
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
[Install]
WantedBy=multi-user.target