diff options
| author | Denis Chevalier <perso@denischevalier.fr> | 2026-08-06 13:37:24 +0200 |
|---|---|---|
| committer | Denis Chevalier <perso@denischevalier.fr> | 2026-08-06 13:37:24 +0200 |
| commit | 1842e4f8f2be20f5fead7ae2bf3a333fcdd9f81b (patch) | |
| tree | 7ce5fa3037ccc9532eefd3a53c1403c460a14918 /etc | |
| parent | 257a7d8b05bf081ea338132012861cf4d196fee1 (diff) | |
| download | postinstall-1842e4f8f2be20f5fead7ae2bf3a333fcdd9f81b.tar.gz postinstall-1842e4f8f2be20f5fead7ae2bf3a333fcdd9f81b.tar.bz2 postinstall-1842e4f8f2be20f5fead7ae2bf3a333fcdd9f81b.zip | |
change systemd override installation
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/systemd/system/cups.service.d/override.conf | 12 | ||||
| -rw-r--r-- | etc/systemd/system/fail2ban.service.d/override.conf | 11 | ||||
| -rw-r--r-- | etc/systemd/system/sshd.service.d/override.conf | 14 |
3 files changed, 37 insertions, 0 deletions
diff --git a/etc/systemd/system/cups.service.d/override.conf b/etc/systemd/system/cups.service.d/override.conf new file mode 100644 index 0000000..d12b406 --- /dev/null +++ b/etc/systemd/system/cups.service.d/override.conf @@ -0,0 +1,12 @@ +[Service] +NoNewPrivileges=yes +ProtectSystem=strict +ProtectHome=yes +ReadWritePaths=/var/spool/cups /var/cache/cups /var/run/cups /etc/cups +PrivateTmp=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +RestrictNamespaces=yes +MemoryDenyWriteExecute=yes + diff --git a/etc/systemd/system/fail2ban.service.d/override.conf b/etc/systemd/system/fail2ban.service.d/override.conf new file mode 100644 index 0000000..f897711 --- /dev/null +++ b/etc/systemd/system/fail2ban.service.d/override.conf @@ -0,0 +1,11 @@ +[Service] +NoNewPrivileges=yes +ProtectSystem=full +PrivateTmp=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictRealtime=yes + diff --git a/etc/systemd/system/sshd.service.d/override.conf b/etc/systemd/system/sshd.service.d/override.conf new file mode 100644 index 0000000..415a729 --- /dev/null +++ b/etc/systemd/system/sshd.service.d/override.conf @@ -0,0 +1,14 @@ +[Service] +NoNewPrivileges=yes +ProtectSystem=strict +ProtectHome=read-only +RuntimeDirectory=sshd +ReadWritePaths=/var/empty +PrivateTmp=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictRealtime=yes +LockPersonality=yes |