diff options
author | Claire <claire.github-309c@sitedethib.com> | 2021-03-25 00:31:15 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-03-25 00:31:15 +0100 |
commit | a2a85d5ae03282c6f9cbf452b9b8f7d948a9f380 (patch) | |
tree | f3f15ea30de78e0fabaa5135a3b3c7b51053e4b6 /dist/mastodon-sidekiq.service | |
parent | d7c1c41859549212a6d34ad869fded16acc17b48 (diff) | |
parent | 5ea53b6158c42660aa61da2a49a3bbf9e2e406d0 (diff) |
Merge pull request #1516 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes
Diffstat (limited to 'dist/mastodon-sidekiq.service')
-rw-r--r-- | dist/mastodon-sidekiq.service | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/dist/mastodon-sidekiq.service b/dist/mastodon-sidekiq.service index 721a86609..0bb0a800f 100644 --- a/dist/mastodon-sidekiq.service +++ b/dist/mastodon-sidekiq.service @@ -12,6 +12,33 @@ Environment="MALLOC_ARENA_MAX=2" ExecStart=/home/mastodon/.rbenv/shims/bundle exec sidekiq -c 25 TimeoutSec=15 Restart=always +# Capabilities +CapabilityBoundingSet= +# Security +NoNewPrivileges=true +# Sandboxing +ProtectSystem=strict +PrivateTmp=true +PrivateDevices=true +PrivateUsers=true +ProtectHostname=true +ProtectKernelLogs=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectControlGroups=true +RestrictAddressFamilies=AF_INET +RestrictAddressFamilies=AF_INET6 +RestrictAddressFamilies=AF_NETLINK +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=true +LockPersonality=true +RestrictRealtime=true +RestrictSUIDSGID=true +PrivateMounts=true +ProtectClock=true +# System Call Filtering +SystemCallArchitectures=native +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap [Install] WantedBy=multi-user.target |