All modules: ProtectSystem = strict

Add ReadWritePaths in all modules, except lnd which has ProtectSystem = full.
2020-05-22 15:47:01 +00:00
parent adc71b892e
commit a040e52854
10 changed files with 11 additions and 1 deletions
@@ -81,6 +81,7 @@ in {
        Type = "oneshot";
        RemainAfterExit = true;
        PrivateNetwork = "true"; # This service needs no network access
+        ReadWritePaths = "${dataDir}";
        CapabilityBoundingSet = "CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER";
      };
    };