diff options
| author | yalh76 <yalh@yahoo.com> | 2022-02-18 22:15:40 +0100 |
|---|---|---|
| committer | yalh76 <yalh@yahoo.com> | 2022-02-18 22:15:40 +0100 |
| commit | 467f49bc9336856114d177f9f023f8ecc7914658 (patch) | |
| tree | 0618c5ccb155b9f26d6f18d13572a03dec43c746 /conf/mastodon-sidekiq.service | |
| parent | 2f33630edba994036a19b02301d9acecd0d43e5c (diff) | |
| download | mastodon_ynh-467f49bc9336856114d177f9f023f8ecc7914658.tar.gz mastodon_ynh-467f49bc9336856114d177f9f023f8ecc7914658.tar.bz2 mastodon_ynh-467f49bc9336856114d177f9f023f8ecc7914658.zip | |
Update mastodon-sidekiq.service
Diffstat (limited to 'conf/mastodon-sidekiq.service')
| -rw-r--r-- | conf/mastodon-sidekiq.service | 28 |
1 files changed, 14 insertions, 14 deletions
diff --git a/conf/mastodon-sidekiq.service b/conf/mastodon-sidekiq.service index 83c11e6..24554c1 100644 --- a/conf/mastodon-sidekiq.service +++ b/conf/mastodon-sidekiq.service @@ -19,15 +19,15 @@ StandardError=syslog # Depending on specificities of your service/app, you may need to tweak these # .. but this should be a good baseline # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -#NoNewPrivileges=yes -#PrivateTmp=yes +NoNewPrivileges=no +PrivateTmp=yes #PrivateDevices=yes #RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK #RestrictNamespaces=yes #RestrictRealtime=yes -#DevicePolicy=closed -#ProtectSystem=full -#ProtectControlGroups=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes #ProtectKernelModules=yes #ProtectKernelTunables=yes #LockPersonality=yes @@ -35,15 +35,15 @@ StandardError=syslog # Denying access to capabilities that should not be relevant for webapps # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html -#CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD -#CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE -#CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT -#CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK -#CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM -#CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG -#CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE -#CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW -#CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG [Install] WantedBy=multi-user.target |