From 3114c2c2cc1009ac88f043f97927b300710ef29e Mon Sep 17 00:00:00 2001 From: Rigel Kent Date: Wed, 5 Dec 2018 19:39:48 +0100 Subject: [PATCH] hardening systemd unit --- support/systemd/peertube.service | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/support/systemd/peertube.service b/support/systemd/peertube.service index 88856385c..c1bdcf760 100644 --- a/support/systemd/peertube.service +++ b/support/systemd/peertube.service @@ -15,5 +15,19 @@ StandardError=syslog SyslogIdentifier=peertube Restart=always +; Some security directives. +; Use private /tmp and /var/tmp folders inside a new file system namespace, +; which are discarded after the process stops. +PrivateTmp=true +; Mount /usr, /boot, and /etc as read-only for processes invoked by this service. +ProtectSystem=full +; Sets up a new /dev mount for the process and only adds API pseudo devices +; like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled +; by default because it may not work on devices like the Raspberry Pi. +PrivateDevices=false +; Ensures that the service process and all its children can never gain new +; privileges through execve(). +NoNewPrivileges=true + [Install] WantedBy=multi-user.target -- 2.25.1