mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-11-07 02:08:46 +01:00
48 lines
1.0 KiB
SYSTEMD
48 lines
1.0 KiB
SYSTEMD
[Unit]
|
|
Description=PHP-FPM service for %i
|
|
After=syslog.target network.target
|
|
After=mysqld.service postfix.service
|
|
Requires=php-fpm@.socket
|
|
|
|
[Service]
|
|
Type=notify
|
|
|
|
PrivateTmp=true
|
|
NoNewPrivileges=true
|
|
;PrivateNetwork=true
|
|
PrivateDevices=true
|
|
|
|
ProtectHome=true
|
|
ProtectSystem=full
|
|
InaccessiblePaths=-/var/lib/mysql
|
|
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
ProtectControlGroups=true
|
|
ProtectKernelLogs=true
|
|
ProtectClock=true
|
|
ProtectProc=invisible
|
|
|
|
RestrictRealtime=true
|
|
RestrictNamespaces=true
|
|
RestrictSUIDSGID=true
|
|
|
|
# Restricts the set of socket address families accessible to the processes of this unit.
|
|
# Protects against vulnerabilities such as CVE-2016-8655
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
|
|
|
|
LockPersonality=true
|
|
|
|
MemoryAccounting=yes
|
|
CPUAccounting=yes
|
|
IOAccounting=yes
|
|
|
|
User=%i
|
|
Group=%i
|
|
Environment="FPM_SOCKETS=/run/php-fpm/%i.socket=3"
|
|
ExecStart=/usr/bin/php-fpm --nodaemonize --fpm-config /etc/php/php-fpm.d/%i.conf
|
|
ExecReload=/bin/kill -USR2 $MAINPID
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|