Systemd/Hardening: Difference between revisions
→Hardened service unit example: add memorydenywriteexecutable |
m Fix some typos in the example |
||
| Line 165: | Line 165: | ||
"${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt" | "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt" | ||
# For DNS, failably attempts to mount the file | # For DNS, failably attempts to mount the file | ||
"-/etc/ | "-/etc/resolv.conf" | ||
] | ] | ||
# For if the user uses systemd-resolved instead | # For if the user uses systemd-resolved instead | ||
| Line 190: | Line 190: | ||
# | # | ||
# Can almost always be set, or set to an empty string if no network access is required. | # Can almost always be set, or set to an empty string if no network access is required. | ||
RestrictAddressFamilies = [ | |||
"AF_UNIX" # Unix sockets | "AF_UNIX" # Unix sockets | ||
"AF_INET" # ipv4 | "AF_INET" # ipv4 | ||