summaryrefslogtreecommitdiffstats
path: root/roles/common/files/etc/systemd
diff options
context:
space:
mode:
Diffstat (limited to 'roles/common/files/etc/systemd')
-rw-r--r--roles/common/files/etc/systemd/system/bacula-fd.service6
-rw-r--r--roles/common/files/etc/systemd/system/munin-node.service.d/override.conf13
2 files changed, 16 insertions, 3 deletions
diff --git a/roles/common/files/etc/systemd/system/bacula-fd.service b/roles/common/files/etc/systemd/system/bacula-fd.service
index 792d964..119b3a2 100644
--- a/roles/common/files/etc/systemd/system/bacula-fd.service
+++ b/roles/common/files/etc/systemd/system/bacula-fd.service
@@ -9,17 +9,17 @@ ExecStart=/usr/sbin/bacula-fd -f -c /etc/bacula/bacula-fd.conf
# Hardening
NoNewPrivileges=yes
-PrivateDevices=yes
ProtectHome=read-only
ProtectSystem=strict
+ReadWriteDirectories=/var/lib/bacula
+RuntimeDirectory=bacula
PrivateTmp=yes
-ReadWriteDirectories=-/var/lib
-ReadWriteDirectories=-/var/run/bacula
PrivateDevices=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH
[Install]
WantedBy=multi-user.target
diff --git a/roles/common/files/etc/systemd/system/munin-node.service.d/override.conf b/roles/common/files/etc/systemd/system/munin-node.service.d/override.conf
new file mode 100644
index 0000000..53747f6
--- /dev/null
+++ b/roles/common/files/etc/systemd/system/munin-node.service.d/override.conf
@@ -0,0 +1,13 @@
+[Service]
+
+# Hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWriteDirectories=/var/lib/munin-node/plugin-state
+ReadWriteDirectories=/var/log/munin
+RuntimeDirectory=munin
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+CapabilityBoundingSet=CAP_SETUID CAP_SETGID