fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2026-01-09 15:50:26 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

cloud-setup: enable more sandboxing in systemd unit

Browse source 
(cherry picked from commit 667ae99f5d)
This commit is contained in:
Thomas Haller 2019-12-03 08:55:28 +01:00
parent b6b6c63b14
commit 0a45cc71dd
1 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
clients/cloud-setup/nm-cloud-setup.service.in
View file

@ -6,3 +6,22 @@ Type=oneshot
ExecStart=@libexecdir@/nm-cloud-setup
#Environment=NM_CLOUD_SETUP_LOG=TRACE
CapabilityBoundingSet=
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallFilter=@system-service