From 71ab53772fda07e3a9653e4fe1a2ed8cf0aa2888 Mon Sep 17 00:00:00 2001
From: desbma <desbma@users.noreply.github.com>
Date: Sun, 13 Jan 2019 23:32:07 +0100
Subject: [PATCH] Add systemd hardening options

---
 systemd/hddfancontrol.service | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/systemd/hddfancontrol.service b/systemd/hddfancontrol.service
index b3374be..4dbdd24 100644
--- a/systemd/hddfancontrol.service
+++ b/systemd/hddfancontrol.service
@@ -9,5 +9,15 @@ ExecStart=/usr/bin/hddfancontrol $HDDFANCONTROL_ARGS
 CPUSchedulingPolicy=rr
 CPUSchedulingPriority=49
 
+# Hardening
+ProtectSystem=strict
+PrivateTmp=true
+ProtectHome=true
+SystemCallArchitectures=native
+MemoryDenyWriteExecute=true
+CapabilityBoundingSet=CAP_SYS_RAWIO
+AmbientCapabilities=CAP_SYS_RAWIO
+NoNewPrivileges=true
+
 [Install]
 WantedBy=multi-user.target