From b750101eb236130cf056c675997decbac904cc49 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 17:35:18 +0200 Subject: Adding upstream version 252.22. Signed-off-by: Daniel Baumann --- src/portable/profile/strict/service.conf | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 src/portable/profile/strict/service.conf (limited to 'src/portable/profile/strict/service.conf') diff --git a/src/portable/profile/strict/service.conf b/src/portable/profile/strict/service.conf new file mode 100644 index 0000000..f924e10 --- /dev/null +++ b/src/portable/profile/strict/service.conf @@ -0,0 +1,29 @@ +# The "strict" security profile for services, all options turned on + +[Service] +MountAPIVFS=yes +BindReadOnlyPaths=/dev/log /run/systemd/journal/socket /run/systemd/journal/stdout +BindReadOnlyPaths=/etc/machine-id +DynamicUser=yes +RemoveIPC=yes +CapabilityBoundingSet= +PrivateTmp=yes +PrivateDevices=yes +PrivateUsers=yes +ProtectSystem=strict +ProtectHome=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +RestrictAddressFamilies=AF_UNIX +LockPersonality=yes +NoNewPrivileges=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +PrivateNetwork=yes +IPAddressDeny=any +TasksMax=4 -- cgit v1.2.3