diff options
| author | Yurii Izorkin <izorkin@elven.pw> | 2021-10-25 17:31:20 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-10-25 16:31:20 +0200 |
| commit | a9ff5c830951eead9c4cfa04532d378220ccd8e4 (patch) | |
| tree | 6553c853b878b8c3f7ba560d18b10ad2e35663c3 /dist/mastodon-sidekiq.service | |
| parent | c8ce728705c0a5f85e55ed68101938a04f94ffb3 (diff) | |
templates/systemd/mastodon: update sandbox mode (#16235)
* templates/systemd/mastodon: add new sandboxing options * templates/systemd/mastodon: add '@privileged' and remove duplicates SystemCallFilters * templates/systemd/mastodon: add '@ipc' SystemCallFilter * templates/systemd/mastodon: add '@memlock' SystemCallFilter * templates/systemd/mastodon: allow '@resources' filter to mastodon-web service
Diffstat (limited to 'dist/mastodon-sidekiq.service')
| -rw-r--r-- | dist/mastodon-sidekiq.service | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/dist/mastodon-sidekiq.service b/dist/mastodon-sidekiq.service index 35b121cd7..7d2d72e99 100644 --- a/dist/mastodon-sidekiq.service +++ b/dist/mastodon-sidekiq.service @@ -13,6 +13,9 @@ Environment="LD_PRELOAD=libjemalloc.so" ExecStart=/home/mastodon/.rbenv/shims/bundle exec sidekiq -c 25 TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -35,11 +38,15 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid +SystemCallFilter=@chown +SystemCallFilter=pipe +SystemCallFilter=pipe2 [Install] WantedBy=multi-user.target |