diff options
Diffstat (limited to 'dist/mastodon-web.service')
| -rw-r--r-- | dist/mastodon-web.service | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/dist/mastodon-web.service b/dist/mastodon-web.service index f41efd2b0..16d1d5653 100644 --- a/dist/mastodon-web.service +++ b/dist/mastodon-web.service @@ -13,6 +13,9 @@ ExecStart=/home/mastodon/.rbenv/shims/bundle exec puma -C config/puma.rb ExecReload=/bin/kill -SIGUSR1 $MAINPID TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -35,11 +38,15 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @resources @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid +SystemCallFilter=@chown +SystemCallFilter=pipe +SystemCallFilter=pipe2 [Install] WantedBy=multi-user.target |