28 lines
881 B
Text
28 lines
881 B
Text
[Service]
|
|
# Hardening
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
#PrivateDevices=true #breaks tun usage
|
|
#ProtectProc=invisible
|
|
PrivateTmp=yes
|
|
ProtectClock=true
|
|
ProtectControlGroups=true
|
|
ProtectHome=read-only
|
|
ProtectKernelLogs=true
|
|
#ProtectKernelModules=true
|
|
#ProtectSystem=strict
|
|
#ReadOnlyPaths=/etc/NetworkManager
|
|
ReadOnlyPaths=-/home
|
|
#ReadWritePaths=-/etc/NetworkManager/system-connections
|
|
ReadWritePaths=-/etc/sysconfig/network-scripts
|
|
ReadWritePaths=/var/lib/NetworkManager
|
|
ReadWritePaths=-/var/run/NetworkManager
|
|
ReadWritePaths=-/run/NetworkManager
|
|
RemoveIPC=true
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
UMask=0077
|