diff options
| author | yalh76 <yalh@yahoo.com> | 2022-01-14 19:38:00 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-01-14 19:38:00 +0100 |
| commit | 4d413848bf444586e28f3658de0ebe36d6ebf059 (patch) | |
| tree | 19ecc95d4b3b68a0d74f3f1591a248b8de6ded47 /conf/mastodon-sidekiq.service | |
| parent | fa8a9d4eed460fa73926e7874313091dffb7b9fc (diff) | |
| parent | 536f2d51f2dade739c2e2ed3df96f472a2ad951b (diff) | |
| download | mastodon_ynh-4d413848bf444586e28f3658de0ebe36d6ebf059.tar.gz mastodon_ynh-4d413848bf444586e28f3658de0ebe36d6ebf059.tar.bz2 mastodon_ynh-4d413848bf444586e28f3658de0ebe36d6ebf059.zip | |
Merge pull request #293 from YunoHost-Apps/testing
Full upgrade
Diffstat (limited to 'conf/mastodon-sidekiq.service')
| -rw-r--r-- | conf/mastodon-sidekiq.service | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/conf/mastodon-sidekiq.service b/conf/mastodon-sidekiq.service index 094813f..7fe2cc9 100644 --- a/conf/mastodon-sidekiq.service +++ b/conf/mastodon-sidekiq.service @@ -14,5 +14,35 @@ TimeoutSec=15 Restart=always StandardError=syslog +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target |