arch_boxes_sync: Quick service filesystem hardening

Should protect the filesystem from the script going amok and nuking the filesystem (shouldn't happen).

arch_boxes_sync: Quick service filesystem hardening
Should protect the filesystem from the script going amok and nuking the filesystem (shouldn't happen).
b615d2f9 · Kristian Klausen · 004a08db · b615d2f9
Commit b615d2f9 authored Feb 26, 2021 by Kristian Klausen
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

roles/arch_boxes_sync/files/arch-boxes-sync.service roles/arch_boxes_sync/files/arch-boxes-sync.service +3 -0

No files found.
--- a/roles/arch_boxes_sync/files/arch-boxes-sync.service
+++ b/roles/arch_boxes_sync/files/arch-boxes-sync.service
@@ -4,3 +4,6 @@ Description=Sync arch-boxes releases
 [Service]
 Type=oneshot
 ExecStart=/usr/local/bin/arch-boxes-sync
+ProtectSystem=strict
+PrivateTmp=true
+ReadWritePaths=/srv/ftp/images