|
|
|
@ -164,6 +164,35 @@ in |
|
|
|
|
optional (cfg.dataDir == defaultdataDir) "galene/data" ++ |
|
|
|
|
optional (cfg.groupsDir == defaultgroupsDir) "galene/groups" ++ |
|
|
|
|
optional (cfg.recordingsDir == defaultrecordingsDir) "galene/recordings"; |
|
|
|
|
|
|
|
|
|
# Hardening |
|
|
|
|
CapabilityBoundingSet = [ "" ]; |
|
|
|
|
DeviceAllow = [ "" ]; |
|
|
|
|
LockPersonality = true; |
|
|
|
|
MemoryDenyWriteExecute = true; |
|
|
|
|
NoNewPrivileges = true; |
|
|
|
|
PrivateDevices = true; |
|
|
|
|
PrivateTmp = true; |
|
|
|
|
PrivateUsers = true; |
|
|
|
|
ProcSubset = "pid"; |
|
|
|
|
ProtectClock = true; |
|
|
|
|
ProtectControlGroups = true; |
|
|
|
|
ProtectHome = true; |
|
|
|
|
ProtectHostname = true; |
|
|
|
|
ProtectKernelLogs = true; |
|
|
|
|
ProtectKernelModules = true; |
|
|
|
|
ProtectKernelTunables = true; |
|
|
|
|
ProtectProc = "invisible"; |
|
|
|
|
ProtectSystem = "strict"; |
|
|
|
|
ReadWritePaths = cfg.recordingsDir; |
|
|
|
|
RemoveIPC = true; |
|
|
|
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; |
|
|
|
|
RestrictNamespaces = true; |
|
|
|
|
RestrictRealtime = true; |
|
|
|
|
RestrictSUIDSGID = true; |
|
|
|
|
SystemCallArchitectures = "native"; |
|
|
|
|
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; |
|
|
|
|
UMask = "0077"; |
|
|
|
|
} |
|
|
|
|
]; |
|
|
|
|
}; |
|
|
|
|