Introduce systemd.exec restrictions for better security

2018-12-07 21:54:44 +01:00
parent 8e155012a7
commit 4f6539b31d
8 changed files with 120 additions and 0 deletions
--- a/etc/systemd/system/dovecot.service.d/custom.conf
+++ b/etc/systemd/system/dovecot.service.d/custom.conf
@ -0,0 +1,17 @@
+[Service]
+LimitNOFILE=100000
+ProtectSystem=strict
+PrivateTmp=true
+NoNewPrivileges=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallArchitectures=native
+BindPaths=/run/dovecot/
+BindPaths=/var/run/dovecot/
+BindPaths=/var/lib/dovecot/
+InaccessiblePaths=/var/www/
+InaccessiblePaths=/root/