mirror/ infrastructure
1
1
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/infrastructure.git synced 2024-06-02 07:16:06 +02:00
Code Issues

planet: harden planet generation service 

Harden the unit by limiting access to the system and dissallowing
privilege escalation.
This commit is contained in:
Jelle van der Waa 2019-01-23 14:19:38 +01:00
parent 155104d445
commit a65a62e259
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
roles/planet/templates/planet.service.j2
View File

@ -6,3 +6,10 @@ Type=oneshot
User=http
ExecStart=/usr/bin/python2 planet.py archplanet/config.ini
WorkingDirectory={{ planet_dir }}
NoNewPrivileges=yes
ProtectHome=true
ProtectSystem=full
PrivateTmp=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true