diff options
Diffstat (limited to 'src/nm-cloud-setup')
| -rw-r--r-- | src/nm-cloud-setup/nm-cloud-setup.service.in | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/nm-cloud-setup/nm-cloud-setup.service.in b/src/nm-cloud-setup/nm-cloud-setup.service.in index a2b4581f..e73654d8 100644 --- a/src/nm-cloud-setup/nm-cloud-setup.service.in +++ b/src/nm-cloud-setup/nm-cloud-setup.service.in @@ -22,22 +22,30 @@ ExecStart=@libexecdir@/nm-cloud-setup #Environment=NM_CLOUD_SETUP_ALIYUN=yes CapabilityBoundingSet= +KeyringMode=private LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes PrivateDevices=yes PrivateTmp=yes +PrivateUsers=yes +ProtectClock=yes ProtectControlGroups=yes ProtectHome=yes ProtectHostname=yes ProtectKernelLogs=yes ProtectKernelModules=yes ProtectKernelTunables=yes +ProtectProc=invisible ProtectSystem=strict -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 RestrictNamespaces=yes RestrictRealtime=yes RestrictSUIDSGID=yes +SystemCallArchitectures=native + +DevicePolicy=closed +PrivateNetwork=no +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 SystemCallFilter=@system-service [Install] |