2 files changed, 12 insertions, 0 deletions
diff --git a/roles/munin-master/files/etc/systemd/system/munin-cgi-graph.service b/roles/munin-master/files/etc/systemd/system/munin-cgi-graph.service
index c8a3609..b8e6012 100644
--- a/roles/munin-master/files/etc/systemd/system/munin-cgi-graph.service
+++ b/roles/munin-master/files/etc/systemd/system/munin-cgi-graph.service
@@ -1,22 +1,28 @@
 [Unit]
 Description=Munin CGI Graph Service
 After=network.target
 PartOf=munin.service
 Requires=munin-cgi-graph.socket
 
 [Service]
 StandardInput=socket
 User=www-data
 Group=munin
 ExecStart=/usr/lib/munin/cgi/munin-cgi-graph
 
 # Hardening
 NoNewPrivileges=yes
 PrivateDevices=yes
 ProtectHome=yes
 ProtectSystem=strict
 ReadWriteDirectories=-/var/log/munin
 ReadWriteDirectories=-/var/lib/munin/cgi-tmp/munin-cgi-graph
+PrivateDevices=yes
+PrivateNetwork=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=
 
 [Install]
 WantedBy=multi-user.target
diff --git a/roles/munin-master/files/etc/systemd/system/munin-cgi-html.service b/roles/munin-master/files/etc/systemd/system/munin-cgi-html.service
index 3c0c0e5..0e66b3f 100644
--- a/roles/munin-master/files/etc/systemd/system/munin-cgi-html.service
+++ b/roles/munin-master/files/etc/systemd/system/munin-cgi-html.service
@@ -1,21 +1,27 @@
 [Unit]
 Description=Munin CGI HTML Service
 After=network.target
 PartOf=munin.service
 Requires=munin-cgi-html.socket
 
 [Service]
 StandardInput=socket
 User=www-data
 Group=munin
 ExecStart=/usr/lib/munin/cgi/munin-cgi-html
 
 # Hardening
 NoNewPrivileges=yes
 PrivateDevices=yes
 ProtectHome=yes
 ProtectSystem=strict
 ReadWriteDirectories=-/var/log/munin
+PrivateDevices=yes
+PrivateNetwork=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=
 
 [Install]
 WantedBy=multi-user.target