Verified Commit 9a831e39 authored by Jelle van der Waa's avatar Jelle van der Waa 🚧
Browse files

Harden the aurweb mkpkglists service

This service only requires MySQL access and access to the aur home
directory (/srv/http/aurweb) to write the package/pkgbase/user files.
parent 7a58b4b8
......@@ -7,3 +7,30 @@ After=mysqld.service
Type=oneshot
User={{ aurweb_user }}
ExecStart=/usr/local/bin/aurweb-mkpkglists
NoNewPrivileges=true
LockPersonality=true
CapabilityBoundingSet=
ReadWritePaths={{ aurweb_dir }}
PrivateDevices=true
PrivateTmp=true
ProtectSystem=strict
MemoryDenyWriteExecute=true
RemoveIPC=true
RestrictRealtime=true
RestrictNamespaces=true
RestrictSUIDSGID=true
RestrictAddressFamilies=AF_UNIX
ProtectHostname=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectClock=true
ProtectProc=noaccess
SystemCallArchitectures=native
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment