summaryrefslogtreecommitdiffstats
path: root/roles/common/files/etc/systemd/system
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2020-05-16 02:52:55 +0200
committerGuilhem Moulin <guilhem@fripost.org>2020-05-16 05:45:59 +0200
commitbac7811d2b35252b7a83a45d75bb344b4b1776a9 (patch)
tree02176a15d570cab6dbd55b52b6df5c7b7b0538b1 /roles/common/files/etc/systemd/system
parentc4f24043baeccc95556fb9c3c032505ecadb5fbd (diff)
Upgrade baseline to Debian 10.
Diffstat (limited to 'roles/common/files/etc/systemd/system')
-rw-r--r--roles/common/files/etc/systemd/system/bacula-fd.service6
-rw-r--r--roles/common/files/etc/systemd/system/munin-node.service.d/override.conf13
2 files changed, 16 insertions, 3 deletions
diff --git a/roles/common/files/etc/systemd/system/bacula-fd.service b/roles/common/files/etc/systemd/system/bacula-fd.service
index 792d964..119b3a2 100644
--- a/roles/common/files/etc/systemd/system/bacula-fd.service
+++ b/roles/common/files/etc/systemd/system/bacula-fd.service
@@ -9,17 +9,17 @@ ExecStart=/usr/sbin/bacula-fd -f -c /etc/bacula/bacula-fd.conf
# Hardening
NoNewPrivileges=yes
-PrivateDevices=yes
ProtectHome=read-only
ProtectSystem=strict
+ReadWriteDirectories=/var/lib/bacula
+RuntimeDirectory=bacula
PrivateTmp=yes
-ReadWriteDirectories=-/var/lib
-ReadWriteDirectories=-/var/run/bacula
PrivateDevices=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH
[Install]
WantedBy=multi-user.target
diff --git a/roles/common/files/etc/systemd/system/munin-node.service.d/override.conf b/roles/common/files/etc/systemd/system/munin-node.service.d/override.conf
new file mode 100644
index 0000000..53747f6
--- /dev/null
+++ b/roles/common/files/etc/systemd/system/munin-node.service.d/override.conf
@@ -0,0 +1,13 @@
+[Service]
+
+# Hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWriteDirectories=/var/lib/munin-node/plugin-state
+ReadWriteDirectories=/var/log/munin
+RuntimeDirectory=munin
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+CapabilityBoundingSet=CAP_SETUID CAP_SETGID