Improve systemd protections

README.md

@@ -25,10 +25,10 @@ Password and other usefull information will be sent to you after installation.
 
 * to be confirmed
   * [x] ARM support
+  * [x] Improve systemd protection
 
 * to be added:
   * [ ] Improve log file and add logrotate
-  * [ ] Improve systemd protection (see: https://github.com/YunoHost-Apps/kresus_ynh/issues/20)
 
 ## Links
 

conf/systemd.service

@@ -10,6 +10,13 @@ Type=forking
 ExecStart=/usr/sbin/murmurd -ini __FINALPATH__/mumble-server.ini
 PIDFile=/var/run/mumble-server/__APP__.pid
 ExecReload=/bin/kill -s HUP $MAINPID
+PrivateDevices=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ReadWritePaths=__FINALPATH__ /var/log/mumble-server /var/run/mumble-server
 
 [Install]
 WantedBy=multi-user.target

manifest.json

@@ -15,7 +15,7 @@
     "requirements": {
         "yunohost": ">= 3.1.0"
     },
-    "version": "1.2.8~ynh4",
+    "version": "1.2.8~ynh5",
     "multi_instance": true,
     "services": [
     ],