diff options
| author | yalh76 <yalh@yahoo.com> | 2022-02-19 14:51:21 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-02-19 14:51:21 +0100 |
| commit | 1398b224068b0bcc25efff2692279d4c8aca143e (patch) | |
| tree | 54ee0036971ace7f98f7d703179482daa2995f30 /conf | |
| parent | 3f728834a15657f72efbef59d5991e03b5babb66 (diff) | |
| parent | ab638806758756ead67c96cf6deca470b16e7c56 (diff) | |
| download | mastodon_ynh-1398b224068b0bcc25efff2692279d4c8aca143e.tar.gz mastodon_ynh-1398b224068b0bcc25efff2692279d4c8aca143e.tar.bz2 mastodon_ynh-1398b224068b0bcc25efff2692279d4c8aca143e.zip | |
Merge pull request #310 from YunoHost-Apps/testing
better sidekiq
Diffstat (limited to 'conf')
| -rw-r--r-- | conf/mastodon-sidekiq.service | 28 |
1 files changed, 14 insertions, 14 deletions
diff --git a/conf/mastodon-sidekiq.service b/conf/mastodon-sidekiq.service index 83c11e6..24554c1 100644 --- a/conf/mastodon-sidekiq.service +++ b/conf/mastodon-sidekiq.service @@ -19,15 +19,15 @@ StandardError=syslog # Depending on specificities of your service/app, you may need to tweak these # .. but this should be a good baseline # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -#NoNewPrivileges=yes -#PrivateTmp=yes +NoNewPrivileges=no +PrivateTmp=yes #PrivateDevices=yes #RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK #RestrictNamespaces=yes #RestrictRealtime=yes -#DevicePolicy=closed -#ProtectSystem=full -#ProtectControlGroups=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes #ProtectKernelModules=yes #ProtectKernelTunables=yes #LockPersonality=yes @@ -35,15 +35,15 @@ StandardError=syslog # Denying access to capabilities that should not be relevant for webapps # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html -#CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD -#CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE -#CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT -#CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK -#CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM -#CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG -#CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE -#CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW -#CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG [Install] WantedBy=multi-user.target |