Add systemd hardening options

2019-01-13 23:32:07 +01:00
parent e666629aaa
commit 71ab53772f
1 changed files with 10 additions and 0 deletions
@@ -9,5 +9,15 @@ ExecStart=/usr/bin/hddfancontrol $HDDFANCONTROL_ARGS
 CPUSchedulingPolicy=rr
 CPUSchedulingPriority=49

+# Hardening
+ProtectSystem=strict
+PrivateTmp=true
+ProtectHome=true
+SystemCallArchitectures=native
+MemoryDenyWriteExecute=true
+CapabilityBoundingSet=CAP_SYS_RAWIO
+AmbientCapabilities=CAP_SYS_RAWIO
+NoNewPrivileges=true
+
 [Install]
 WantedBy=multi-user.target