Lock down the Conduit process in the systemd unit
This will secure the service more and allow only what is necessary.
This commit is contained in:
parent
1b4a79d47c
commit
1a341543ba
1 changed files with 27 additions and 0 deletions
27
debian/matrix-conduit.service
vendored
27
debian/matrix-conduit.service
vendored
|
@ -7,6 +7,33 @@ User=_matrix-conduit
|
||||||
Group=_matrix-conduit
|
Group=_matrix-conduit
|
||||||
Type=simple
|
Type=simple
|
||||||
|
|
||||||
|
AmbientCapabilities=
|
||||||
|
CapabilityBoundingSet=
|
||||||
|
LockPersonality=yes
|
||||||
|
MemoryDenyWriteExecute=yes
|
||||||
|
NoNewPrivileges=yes
|
||||||
|
ProtectClock=yes
|
||||||
|
ProtectControlGroups=yes
|
||||||
|
ProtectHome=yes
|
||||||
|
ProtectHostname=yes
|
||||||
|
ProtectKernelLogs=yes
|
||||||
|
ProtectKernelModules=yes
|
||||||
|
ProtectKernelTunables=yes
|
||||||
|
ProtectSystem=strict
|
||||||
|
PrivateDevices=yes
|
||||||
|
PrivateMounts=yes
|
||||||
|
PrivateTmp=yes
|
||||||
|
PrivateUsers=yes
|
||||||
|
RemoveIPC=yes
|
||||||
|
RestrictAddressFamilies=AF_INET AF_INET6
|
||||||
|
RestrictNamespaces=yes
|
||||||
|
RestrictRealtime=yes
|
||||||
|
RestrictSUIDSGID=yes
|
||||||
|
SystemCallArchitectures=native
|
||||||
|
SystemCallFilter=@system-service
|
||||||
|
SystemCallErrorNumber=EPERM
|
||||||
|
StateDirectory=matrix-conduit
|
||||||
|
|
||||||
Environment="ROCKET_ENV=production"
|
Environment="ROCKET_ENV=production"
|
||||||
Environment="ROCKET_DATABASE_PATH=/var/lib/matrix-conduit"
|
Environment="ROCKET_DATABASE_PATH=/var/lib/matrix-conduit"
|
||||||
EnvironmentFile=/etc/matrix-conduit/debian
|
EnvironmentFile=/etc/matrix-conduit/debian
|
||||||
|
|
Loading…
Reference in a new issue