diff options
| author | yalh76 <yalh@yahoo.com> | 2022-01-07 01:25:26 +0100 |
|---|---|---|
| committer | yalh76 <yalh@yahoo.com> | 2022-01-07 01:25:26 +0100 |
| commit | a40b4e0e0b05ff40ab10f749435e880322ea9ba6 (patch) | |
| tree | 19ecc95d4b3b68a0d74f3f1591a248b8de6ded47 /conf/mastodon-web.service | |
| parent | 1476f17251ea0b339390cfa5210e258342ea5a4a (diff) | |
| download | mastodon_ynh-a40b4e0e0b05ff40ab10f749435e880322ea9ba6.tar.gz mastodon_ynh-a40b4e0e0b05ff40ab10f749435e880322ea9ba6.tar.bz2 mastodon_ynh-a40b4e0e0b05ff40ab10f749435e880322ea9ba6.zip | |
Full upgrade
Diffstat (limited to 'conf/mastodon-web.service')
| -rw-r--r-- | conf/mastodon-web.service | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/conf/mastodon-web.service b/conf/mastodon-web.service index e853df5..3285e76 100644 --- a/conf/mastodon-web.service +++ b/conf/mastodon-web.service @@ -14,5 +14,35 @@ TimeoutSec=15 Restart=always StandardError=syslog +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target |