blob: 415a7293e78bb1cdc11c0af85604a6b335970260 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
[Service]
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=read-only
RuntimeDirectory=sshd
ReadWritePaths=/var/empty
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictRealtime=yes
LockPersonality=yes
|
