service hardening: Add PrivateUsers

Exceptions in webindex & onion-chef
2020-05-22 16:16:19 +00:00
parent 1c75543f2f
commit e34d1c884e
3 changed files with 3 additions and 0 deletions
@@ -81,6 +81,7 @@ in {
        Type = "oneshot";
        RemainAfterExit = true;
        PrivateNetwork = "true"; # This service needs no network access
+        PrivateUsers = "false";
        ReadWritePaths = "${dataDir}";
        CapabilityBoundingSet = "CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER";
      };