summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--roles/IMAP/files/etc/systemd/system/dovecot-auth-proxy.service3
-rw-r--r--roles/MSA/files/etc/systemd/system/postfix-sender-login.service3
-rw-r--r--roles/bacula-dir/files/etc/systemd/system/bacula-director.service3
-rw-r--r--roles/bacula-sd/files/etc/systemd/system/bacula-sd.service3
-rw-r--r--roles/common/files/etc/systemd/system/bacula-fd.service3
-rw-r--r--roles/common/files/etc/systemd/system/stunnel4@.service3
-rw-r--r--roles/lists/files/etc/systemd/system/wwsympa.service2
-rw-r--r--roles/munin-master/files/etc/systemd/system/munin-cgi-graph.service3
-rw-r--r--roles/munin-master/files/etc/systemd/system/munin-cgi-html.service3
9 files changed, 9 insertions, 17 deletions
diff --git a/roles/IMAP/files/etc/systemd/system/dovecot-auth-proxy.service b/roles/IMAP/files/etc/systemd/system/dovecot-auth-proxy.service
index ea5895c..7e790e3 100644
--- a/roles/IMAP/files/etc/systemd/system/dovecot-auth-proxy.service
+++ b/roles/IMAP/files/etc/systemd/system/dovecot-auth-proxy.service
@@ -13,9 +13,8 @@ ExecStart=/usr/local/bin/dovecot-auth-proxy.pl
# Hardening
NoNewPrivileges=yes
PrivateDevices=yes
-ProtectSystem=full
+ProtectSystem=strict
ProtectHome=read-only
-ReadOnlyDirectories=/
RestrictAddressFamilies=
[Install]
diff --git a/roles/MSA/files/etc/systemd/system/postfix-sender-login.service b/roles/MSA/files/etc/systemd/system/postfix-sender-login.service
index 3ceb310..09204fa 100644
--- a/roles/MSA/files/etc/systemd/system/postfix-sender-login.service
+++ b/roles/MSA/files/etc/systemd/system/postfix-sender-login.service
@@ -14,8 +14,7 @@ ExecStart=/usr/local/bin/postfix-sender-login.pl
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=yes
-ProtectSystem=full
-ReadOnlyDirectories=/
+ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX
[Install]
diff --git a/roles/bacula-dir/files/etc/systemd/system/bacula-director.service b/roles/bacula-dir/files/etc/systemd/system/bacula-director.service
index 8f952c6..2c09f61 100644
--- a/roles/bacula-dir/files/etc/systemd/system/bacula-director.service
+++ b/roles/bacula-dir/files/etc/systemd/system/bacula-director.service
@@ -14,8 +14,7 @@ ExecStart=/usr/sbin/bacula-dir -c /etc/bacula/bacula-dir.conf
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=yes
-ProtectSystem=full
-ReadOnlyDirectories=/
+ProtectSystem=strict
ReadWriteDirectories=-/var/lib/bacula
ReadWriteDirectories=-/var/log/bacula
ReadWriteDirectories=-/var/run/bacula
diff --git a/roles/bacula-sd/files/etc/systemd/system/bacula-sd.service b/roles/bacula-sd/files/etc/systemd/system/bacula-sd.service
index 698ad17..0e27af3 100644
--- a/roles/bacula-sd/files/etc/systemd/system/bacula-sd.service
+++ b/roles/bacula-sd/files/etc/systemd/system/bacula-sd.service
@@ -14,8 +14,7 @@ ExecStart=/usr/sbin/bacula-sd -c /etc/bacula/bacula-sd.conf
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=yes
-ProtectSystem=full
-ReadOnlyDirectories=/
+ProtectSystem=strict
ReadWriteDirectories=-/var/lib/bacula
ReadWriteDirectories=-/var/run/bacula
ReadWriteDirectories=/mnt/backup/bacula
diff --git a/roles/common/files/etc/systemd/system/bacula-fd.service b/roles/common/files/etc/systemd/system/bacula-fd.service
index ee5afe3..68934f1 100644
--- a/roles/common/files/etc/systemd/system/bacula-fd.service
+++ b/roles/common/files/etc/systemd/system/bacula-fd.service
@@ -12,9 +12,8 @@ ExecStart=/usr/sbin/bacula-fd -c /etc/bacula/bacula-fd.conf
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=read-only
-ProtectSystem=full
+ProtectSystem=strict
PrivateTmp=yes
-ReadOnlyDirectories=/
ReadWriteDirectories=-/var/lib
ReadWriteDirectories=-/var/run/bacula
diff --git a/roles/common/files/etc/systemd/system/stunnel4@.service b/roles/common/files/etc/systemd/system/stunnel4@.service
index e53d29e..d634e50 100644
--- a/roles/common/files/etc/systemd/system/stunnel4@.service
+++ b/roles/common/files/etc/systemd/system/stunnel4@.service
@@ -16,8 +16,7 @@ Restart=on-failure
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=yes
-ProtectSystem=full
-ReadOnlyDirectories=/
+ProtectSystem=strict
[Install]
WantedBy=multi-user.target
diff --git a/roles/lists/files/etc/systemd/system/wwsympa.service b/roles/lists/files/etc/systemd/system/wwsympa.service
index 4e3d94b..cccf508 100644
--- a/roles/lists/files/etc/systemd/system/wwsympa.service
+++ b/roles/lists/files/etc/systemd/system/wwsympa.service
@@ -14,7 +14,7 @@ ExecStart=/usr/lib/cgi-bin/sympa/wwsympa.fcgi
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=yes
-ProtectSystem=full
+ProtectSystem=strict
PrivateTmp=yes
ReadOnlyDirectories=/
ReadWriteDirectories=-/var/lib/sympa
diff --git a/roles/munin-master/files/etc/systemd/system/munin-cgi-graph.service b/roles/munin-master/files/etc/systemd/system/munin-cgi-graph.service
index 60ab444..c8a3609 100644
--- a/roles/munin-master/files/etc/systemd/system/munin-cgi-graph.service
+++ b/roles/munin-master/files/etc/systemd/system/munin-cgi-graph.service
@@ -14,8 +14,7 @@ ExecStart=/usr/lib/munin/cgi/munin-cgi-graph
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=yes
-ProtectSystem=full
-ReadOnlyDirectories=/
+ProtectSystem=strict
ReadWriteDirectories=-/var/log/munin
ReadWriteDirectories=-/var/lib/munin/cgi-tmp/munin-cgi-graph
diff --git a/roles/munin-master/files/etc/systemd/system/munin-cgi-html.service b/roles/munin-master/files/etc/systemd/system/munin-cgi-html.service
index 119d3a2..3c0c0e5 100644
--- a/roles/munin-master/files/etc/systemd/system/munin-cgi-html.service
+++ b/roles/munin-master/files/etc/systemd/system/munin-cgi-html.service
@@ -14,8 +14,7 @@ ExecStart=/usr/lib/munin/cgi/munin-cgi-html
NoNewPrivileges=yes
PrivateDevices=yes
ProtectHome=yes
-ProtectSystem=full
-ReadOnlyDirectories=/
+ProtectSystem=strict
ReadWriteDirectories=-/var/log/munin
[Install]