From 5c49b66ac3cfa4cd8ded5a7bf06f6b706e891d9f Mon Sep 17 00:00:00 2001
From: Dante <thardev@users.noreply.github.com>
Date: Mon, 20 Jun 2022 12:35:18 +0100
Subject: [PATCH] Systemd hardening add required home dir

---
 conf/systemd.service | 2 +-
 scripts/install      | 5 +++--
 scripts/restore      | 5 +++--
 scripts/upgrade      | 5 +++--
 4 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/conf/systemd.service b/conf/systemd.service
index 1c4fd5e..90371cb 100644
--- a/conf/systemd.service
+++ b/conf/systemd.service
@@ -12,7 +12,7 @@ Restart=always
 RestartSec=3
 
 # Optional hardening to improve security
-ReadWritePaths=/opt/mautrix-whatsapp
+ReadWritePaths=/opt/yunohost/__APP__
 NoNewPrivileges=yes
 MemoryDenyWriteExecute=true
 PrivateDevices=yes
diff --git a/scripts/install b/scripts/install
index ae5b401..b2320ee 100755
--- a/scripts/install
+++ b/scripts/install
@@ -107,8 +107,9 @@ ynh_exec_warn_less ynh_install_app_dependencies $pkg_dependencies
 #=================================================
 ynh_script_progression --message="Configuring system user..." --weight=1
 
-# Create a system user
-ynh_system_user_create --username=$app
+# Create a system user and set home dir to /opt/yunohost/$app so systemd hardening works
+# See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service
+ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app
 
 #=================================================
 # CREATE A POSTGRESQL DATABASE
diff --git a/scripts/restore b/scripts/restore
index 4b78749..a47af8c 100755
--- a/scripts/restore
+++ b/scripts/restore
@@ -66,8 +66,9 @@ test ! -d $final_path || ynh_die --message="There is already a directory: $final
 #=================================================
 ynh_script_progression --message="Recreating the dedicated system user..." --weight=1
 
-# Create the dedicated user (if not existing)
-ynh_system_user_create --username=$app
+# Create a dedicated user (if not existing) and set home dir to /opt/yunohost/$app so systemd hardening works
+# See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service
+ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app
 
 #=================================================
 # RESTORE THE APP MAIN DIR
diff --git a/scripts/upgrade b/scripts/upgrade
index 11ff7f4..b685170 100755
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -134,8 +134,9 @@ ynh_exec_warn_less ynh_install_app_dependencies $pkg_dependencies
 #=================================================
 ynh_script_progression --message="Making sure dedicated system user exists..." --weight=8
 
-# Create a dedicated user (if not existing)
-ynh_system_user_create --username=$app
+# Create a dedicated user (if not existing) and set home dir to /opt/yunohost/$app so systemd hardening works
+# See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service
+ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app
 
 #=================================================
 # DOWNLOAD, CHECK AND UNPACK SOURCE