Verified Commit 7a58b4b8 authored by Jelle van der Waa's avatar Jelle van der Waa 🚧
Browse files

Harden the aurweb aurblup service

This service only requires MySQL access, network connection access and
the ability to create an pyalpm handle to sync the pacman db's to update
the blacklist.
parent ae4935db
......@@ -7,3 +7,28 @@ After=mysqld.service
Type=oneshot
User={{ aurweb_user }}
ExecStart=/usr/local/bin/aurweb-aurblup
ReadWritePaths={{ aurweb_dir }}
NoNewPrivileges=true
LockPersonality=true
CapabilityBoundingSet=
PrivateDevices=true
PrivateTmp=true
ProtectSystem=strict
MemoryDenyWriteExecute=true
RemoveIPC=true
RestrictRealtime=true
RestrictNamespaces=true
RestrictSUIDSGID=true
ProtectHostname=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectClock=true
ProtectProc=noaccess
SystemCallArchitectures=native
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment