YunoHost-Apps/mautrix_whatsapp_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/mautrix_whatsapp_ynh.git synced 2024-09-03 19:46:01 +02:00
Code Issues Activity Actions

Add systemd recommended hardening

Browse source
This commit is contained in:
Dante 2022-06-19 17:48:17 +01:00
parent 2917c74108
commit ae73a9aab3
1 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
conf/systemd.service
View file

@ -11,5 +11,27 @@ ExecStart=/opt/yunohost/__APP__/mautrix-whatsapp -c=/opt/yunohost/__APP__/config
Restart=always Restart=always
RestartSec=3 RestartSec=3
# Optional hardening to improve security
ReadWritePaths=/opt/mautrix-whatsapp
NoNewPrivileges=yes
MemoryDenyWriteExecute=true
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=strict
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
ProtectKernelLogs=true
ProtectKernelTunables=true
ProtectHostname=true
ProtectKernelModules=true
PrivateUsers=true
ProtectClock=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target