Arav/dwelling-radio
1
0
Fork 0
Code Releases 25 Activity

Hardened systemd unit.

Browse Source
This commit is contained in:
Alexander Andreev 2022-03-09 23:13:04 +04:00
parent c89c349267
commit 871d05aec0
Signed by: Arav
GPG Key ID: 1327FE8A374CC86F
1 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
init/systemd/dwelling-radio.service
View File

@ -4,9 +4,32 @@ After=network-online.target
[Service] [Service]
Type=simple Type=simple
Restart=on-failure
User=dwradio User=dwradio
Group=dwradio
ExecStart=/usr/bin/dwelling-radio -conf /etc/dwelling/radio.yaml ExecStart=/usr/bin/dwelling-radio -conf /etc/dwelling/radio.yaml
LogsDirectory=dwelling-radio
RuntimeDirectory=dwelling-radio
Restart=on-failure
AmbientCapabilities=
CapabilityBoundingSet=
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target