summaryrefslogtreecommitdiffstats
path: root/roles/common/files
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2018-12-08 01:06:06 +0100
committerGuilhem Moulin <guilhem@fripost.org>2018-12-09 20:25:39 +0100
commit6a57ea01fd48992883d6dac1b7746e79202215e4 (patch)
treef55ae891ecf05aa19511ce1493ae8631f60826bc /roles/common/files
parentbccbd0d4c0faf46e911284e599cc22da2c9b04d9 (diff)
systemd: Replace ‘ProtectSystem=full’ with ‘ProtectSystem=strict’.
And remove ‘ReadOnlyDirectories=/’ as it's implied by ‘ProtectSystem=strict’.
Diffstat (limited to 'roles/common/files')
-rw-r--r--roles/common/files/etc/systemd/system/bacula-fd.service3
-rw-r--r--roles/common/files/etc/systemd/system/stunnel4@.service3
2 files changed, 2 insertions, 4 deletions
diff --git a/roles/common/files/etc/systemd/system/bacula-fd.service b/roles/common/files/etc/systemd/system/bacula-fd.service
index ee5afe3..68934f1 100644
--- a/roles/common/files/etc/systemd/system/bacula-fd.service
+++ b/roles/common/files/etc/systemd/system/bacula-fd.service
@@ -12,9 +12,8 @@ ExecStart=/usr/sbin/bacula-fd -c /etc/bacula/bacula-fd.conf
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=read-only
-ProtectSystem=full
+ProtectSystem=strict
PrivateTmp=yes
-ReadOnlyDirectories=/
ReadWriteDirectories=-/var/lib
ReadWriteDirectories=-/var/run/bacula
diff --git a/roles/common/files/etc/systemd/system/stunnel4@.service b/roles/common/files/etc/systemd/system/stunnel4@.service
index e53d29e..d634e50 100644
--- a/roles/common/files/etc/systemd/system/stunnel4@.service
+++ b/roles/common/files/etc/systemd/system/stunnel4@.service
@@ -16,8 +16,7 @@ Restart=on-failure
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=yes
-ProtectSystem=full
-ReadOnlyDirectories=/
+ProtectSystem=strict
[Install]
WantedBy=multi-user.target