Radish alpha
h
heartwood
rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5
Radicle Heartwood Protocol & Stack
Radicle
Git
Patches › 714472f1
systemd: add example service hardening
Merged did:key:z6MkkpU9...4mtj opened 8 months ago

Include some trivial sandboxing options in the provided service files as an example and lead users to systemd-analyze security.

While being a trivial change and far from a secure service it is an improvement and may push downstream packagers and/or users to add even a bit of sandboxing.

Activity Changes +9 -0
2 files changed +9 -0 d7aa2d9d → bc4a1390
modified systemd/system/radicle-node.service
@@ -25,6 +25,11 @@ Environment=RAD_HOME=/home/seed/.radicle RUST_BACKTRACE=1 RUST_LOG=info
KillMode=process

Restart=always

RestartSec=3
+ 
# Basic hardening options. For more please refer to `systemd-analyze security`.
+ 
PrivateTmp=true
+ 
ProtectSystem=strict
+ 
NoNewPrivileges=true
+ 
MemoryDenyWriteExecute=true



[Install]

WantedBy=multi-user.target
modified systemd/user/radicle-node.service
@@ -18,6 +18,10 @@ Environment=RUST_LOG=info
KillMode=process

Restart=always

RestartSec=3
+ 
# Basic hardening options. For more please refer to `systemd-analyze security`.
+ 
PrivateTmp=true
+ 
ProtectHome=true
+ 
MemoryDenyWriteExecute=true



[Install]

WantedBy=default.target