Service hardening

Signed-off-by: Morten Linderud <morten@linderud.pw>

Service hardening
8855cd05 · Morten Linderud · Jelle van der Waa · 640b56bc · 8855cd05
Verified Commit 8855cd05 authored 4 years ago by Morten Linderud Committed by Jelle van der Waa 4 years ago
--- a/roles/bugbot/files/bugbot.service
+++ b/roles/bugbot/files/bugbot.service
@@ -5,8 +5,14 @@ Description=The official Arch Linux IRC bugbot
 EnvironmentFile=/srv/bugbot/env
 ExecStart=/srv/bugbot/bugbot.py
 Restart=on-failure
-ProtectSystem=full
+ProtectSystem=strict
 DynamicUser=yes
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+

 [Install]
-WantedBy=default.target
+WantedBy=multi-user.target