Systemd/Hardening: Difference between revisions
m →Hardened service unit example: typo |
m Fix some typos in the example |
||
| (One intermediate revision by one other user not shown) | |||
| Line 165: | Line 165: | ||
"${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt" | "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt" | ||
# For DNS, failably attempts to mount the file | # For DNS, failably attempts to mount the file | ||
"-/etc/ | "-/etc/resolv.conf" | ||
] | ] | ||
# For if the user uses systemd-resolved instead | # For if the user uses systemd-resolved instead | ||
| Line 190: | Line 190: | ||
# | # | ||
# Can almost always be set, or set to an empty string if no network access is required. | # Can almost always be set, or set to an empty string if no network access is required. | ||
RestrictAddressFamilies = [ | |||
"AF_UNIX" # Unix sockets | "AF_UNIX" # Unix sockets | ||
"AF_INET" # ipv4 | "AF_INET" # ipv4 | ||
| Line 366: | Line 366: | ||
# Should almost always be enabled | # Should almost always be enabled | ||
RestrictNamespaces = true; | RestrictNamespaces = true; | ||
# Disables memory being able to be writable and executable. | |||
# The only time this should be disabled is with a JIT runtime like | |||
# .NET, the JVM, and others. | |||
# There are also some C programs that use trampolines that require this | |||
# disabled as well. | |||
# | |||
# Should usually be enabled. | |||
MemoryDenyWriteExecute = true; | |||
}; | }; | ||
}; | }; | ||