diff options
| author | Claire <claire.github-309c@sitedethib.com> | 2021-03-24 10:53:50 +0100 |
|---|---|---|
| committer | Claire <claire.github-309c@sitedethib.com> | 2021-03-24 10:53:50 +0100 |
| commit | f60c99a8fb0c99554fce091cac61d9ed07eef573 (patch) | |
| tree | 27457a4e091b820269daedb2f709ca304bcf5d06 /dist/mastodon-streaming.service | |
| parent | d7c1c41859549212a6d34ad869fded16acc17b48 (diff) | |
| parent | 88d69d3261c2f02278d07dc302ff7fc15bd68e8c (diff) | |
Merge branch 'main' into glitch-soc/merge-upstream
Diffstat (limited to 'dist/mastodon-streaming.service')
| -rw-r--r-- | dist/mastodon-streaming.service | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/dist/mastodon-streaming.service b/dist/mastodon-streaming.service index c324fccf4..1443ca1c8 100644 --- a/dist/mastodon-streaming.service +++ b/dist/mastodon-streaming.service @@ -12,6 +12,33 @@ Environment="STREAMING_CLUSTER_NUM=1" ExecStart=/usr/bin/node ./streaming TimeoutSec=15 Restart=always +# Capabilities +CapabilityBoundingSet= +# Security +NoNewPrivileges=true +# Sandboxing +ProtectSystem=strict +PrivateTmp=true +PrivateDevices=true +PrivateUsers=true +ProtectHostname=true +ProtectKernelLogs=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectControlGroups=true +RestrictAddressFamilies=AF_INET +RestrictAddressFamilies=AF_INET6 +RestrictAddressFamilies=AF_NETLINK +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=true +LockPersonality=true +RestrictRealtime=true +RestrictSUIDSGID=true +PrivateMounts=true +ProtectClock=true +# System Call Filtering +SystemCallArchitectures=native +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap [Install] WantedBy=multi-user.target |