mab122
/
radicle-heartwood-lfs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

systemd: Add example service hardening 

Include some trivial sandboxing options in the provided service files
as an example and lead users to `systemd-analyze security`.

While being a trivial change and far from a secure service it is an
improvement and may push downstream packagers and/or users to add even
a bit of sandboxing.

Signed-off-by: srestegosaurio <lcdt@disroot.org>
This commit is contained in:
srestegosaurio 2025-08-24 04:08:40 +02:00 committed by Lorenz Leutgeb
parent d7aa2d9da2
commit 25decf1617
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
systemd/system/radicle-node.service
View File

@ -25,6 +25,11 @@ Environment=RAD_HOME=/home/seed/.radicle RUST_BACKTRACE=1 RUST_LOG=info
KillMode=process KillMode=process
Restart=always Restart=always
RestartSec=3 RestartSec=3
# Basic hardening options. For more please refer to `systemd-analyze security`.
PrivateTmp=true
ProtectSystem=strict
NoNewPrivileges=true
MemoryDenyWriteExecute=true
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

4
systemd/user/radicle-node.service
View File

@ -18,6 +18,10 @@ Environment=RUST_LOG=info
KillMode=process KillMode=process
Restart=always Restart=always
RestartSec=3 RestartSec=3
# Basic hardening options. For more please refer to `systemd-analyze security`.
PrivateTmp=true
ProtectHome=true
MemoryDenyWriteExecute=true
[Install] [Install]
WantedBy=default.target WantedBy=default.target