Introduce systemd.exec restrictions for better security

2018-12-07 21:54:44 +01:00
parent 8e155012a7
commit 4f6539b31d
8 changed files with 120 additions and 0 deletions
--- a/etc/systemd/system/postfix@.service.d/custom.conf
+++ b/etc/systemd/system/postfix@.service.d/custom.conf
@ -0,0 +1,15 @@
+[Service]
+ProtectSystem=strict
+PrivateTmp=true
+NoNewPrivileges=true
+PrivateDevices=true
+#PrivateUsers=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallArchitectures=native
+BindPaths=/var/spool/
+BindPaths=/var/lib/
+InaccessiblePaths=/var/www/