Update php systemd service files

2020-01-11 13:33:34 +01:00
parent 5abb32402d
commit e9c4b798d5
7 changed files with 9 additions and 10 deletions
--- a/etc/systemd/system/php7.2-fpm@.service
+++ b/etc/systemd/system/php7.2-fpm@.service
@ -14,8 +14,7 @@ LimitNOFILE=100000
 TimeoutStartSec=300
 ProtectSystem=strict
 PrivateTmp=true
-# sendmail requires it... enable once chrooted
-#NoNewPrivileges=true
+NoNewPrivileges=true
 PrivateDevices=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
--- a/etc/systemd/system/php7.2-fpm@default.service
+++ b/etc/systemd/system/php7.2-fpm@default.service
@ -14,7 +14,7 @@ LimitNOFILE=100000
 TimeoutStartSec=300
 ProtectSystem=strict
 PrivateTmp=true
-# sendmail requires it... enable once chrooted
+# sendmail requires it...
 #NoNewPrivileges=true
 PrivateDevices=true
 ProtectKernelTunables=true
@ -27,6 +27,7 @@ ReadWritePaths=-/var/run/
 ReadWritePaths=-/run/
 ReadWritePaths=-/var/local/squirrelmail/
 ReadWritePaths=-/var/www/
+ReadWritePaths=-/var/spool/postfix/
 InaccessiblePaths=-/root/
 CPUQuota=100%
 MemoryHigh=25%
--- a/etc/systemd/system/php7.3-fpm.service
+++ b/etc/systemd/system/php7.3-fpm.service
@ -11,7 +11,6 @@ Type=oneshot
 RemainAfterExit=yes
 ExecStart=/bin/true
 ExecReload=/bin/true
-RuntimeDirectoryPreserve=yes

 [Install]
 WantedBy=multi-user.target
--- a/etc/systemd/system/php7.3-fpm@.service
+++ b/etc/systemd/system/php7.3-fpm@.service
@ -14,8 +14,7 @@ LimitNOFILE=100000
 TimeoutStartSec=300
 ProtectSystem=strict
 PrivateTmp=true
-# sendmail requires it... enable once chrooted
-#NoNewPrivileges=true
+NoNewPrivileges=true
 PrivateDevices=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
--- a/etc/systemd/system/php7.3-fpm@default.service
+++ b/etc/systemd/system/php7.3-fpm@default.service
@ -14,7 +14,7 @@ LimitNOFILE=100000
 TimeoutStartSec=300
 ProtectSystem=strict
 PrivateTmp=true
-# sendmail requires it... enable once chrooted
+# sendmail requires it...
 #NoNewPrivileges=true
 PrivateDevices=true
 ProtectKernelTunables=true
@ -27,6 +27,7 @@ ReadWritePaths=-/var/run/
 ReadWritePaths=-/run/
 ReadWritePaths=-/var/local/squirrelmail/
 ReadWritePaths=-/var/www/
+ReadWritePaths=-/var/spool/postfix/
 InaccessiblePaths=-/root/
 CPUQuota=100%
 MemoryHigh=25%
--- a/etc/systemd/system/php7.4-fpm@.service
+++ b/etc/systemd/system/php7.4-fpm@.service
@ -14,8 +14,7 @@ LimitNOFILE=100000
 TimeoutStartSec=300
 ProtectSystem=strict
 PrivateTmp=true
-# sendmail requires it... enable once chrooted
-#NoNewPrivileges=true
+NoNewPrivileges=true
 PrivateDevices=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
--- a/etc/systemd/system/php7.4-fpm@default.service
+++ b/etc/systemd/system/php7.4-fpm@default.service
@ -14,7 +14,7 @@ LimitNOFILE=100000
 TimeoutStartSec=300
 ProtectSystem=strict
 PrivateTmp=true
-# sendmail requires it... enable once chrooted
+# sendmail requires it...
 #NoNewPrivileges=true
 PrivateDevices=true
 ProtectKernelTunables=true
@ -27,6 +27,7 @@ ReadWritePaths=-/var/run/
 ReadWritePaths=-/run/
 ReadWritePaths=-/var/local/squirrelmail/
 ReadWritePaths=-/var/www/
+ReadWritePaths=-/var/spool/postfix/
 InaccessiblePaths=-/root/
 CPUQuota=100%
 MemoryHigh=25%