service hardening: Add CapabilityBoundingSets

Whitelist with exceptions in webindex and onion-chef
2020-05-22 11:29:54 +00:00
parent 3cd61506e0
commit 81a1c3f908
3 changed files with 3 additions and 0 deletions
@@ -78,6 +78,7 @@ in {
        Type = "oneshot";
        RemainAfterExit = true;
        PrivateNetwork = "true"; # This service needs no network access
+        CapabilityBoundingSet = "CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER";
      };
    };
  };