diff options
Diffstat (limited to 'conf')
| -rw-r--r-- | conf/mastodon-sidekiq.service | 28 |
1 files changed, 14 insertions, 14 deletions
diff --git a/conf/mastodon-sidekiq.service b/conf/mastodon-sidekiq.service index 83c11e6..24554c1 100644 --- a/conf/mastodon-sidekiq.service +++ b/conf/mastodon-sidekiq.service @@ -19,15 +19,15 @@ StandardError=syslog # Depending on specificities of your service/app, you may need to tweak these # .. but this should be a good baseline # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -#NoNewPrivileges=yes -#PrivateTmp=yes +NoNewPrivileges=no +PrivateTmp=yes #PrivateDevices=yes #RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK #RestrictNamespaces=yes #RestrictRealtime=yes -#DevicePolicy=closed -#ProtectSystem=full -#ProtectControlGroups=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes #ProtectKernelModules=yes #ProtectKernelTunables=yes #LockPersonality=yes @@ -35,15 +35,15 @@ StandardError=syslog # Denying access to capabilities that should not be relevant for webapps # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html -#CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD -#CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE -#CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT -#CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK -#CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM -#CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG -#CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE -#CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW -#CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG [Install] WantedBy=multi-user.target |