Add systemd hardening options

2019-01-13 23:32:07 +01:00
parent e666629aaa
commit 71ab53772f
1 changed files with 10 additions and 0 deletions
@@ -9,5 +9,15 @@ ExecStart=/usr/bin/hddfancontrol $HDDFANCONTROL_ARGS
 CPUSchedulingPolicy=rr
 CPUSchedulingPriority=49
 # Hardening
 ProtectSystem=strict
 PrivateTmp=true
 ProtectHome=true
 SystemCallArchitectures=native
 MemoryDenyWriteExecute=true
 CapabilityBoundingSet=CAP_SYS_RAWIO
 AmbientCapabilities=CAP_SYS_RAWIO
 NoNewPrivileges=true
 [Install]
 WantedBy=multi-user.target