From 42bdffe7965568ff651899b35bfa6dceeb757d24 Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Thu, 30 Jun 2016 10:27:06 -0400 Subject: net-misc/radvd: systemd hardening Improve the systemd unit by having radvd never run as root, restricting capabilities as much as possible, and limiting file system access. Gentoo-bug: 587588 --- net-misc/radvd/files/radvd.service | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'net-misc/radvd') diff --git a/net-misc/radvd/files/radvd.service b/net-misc/radvd/files/radvd.service index d9095f625a9c..a3ac66f84963 100644 --- a/net-misc/radvd/files/radvd.service +++ b/net-misc/radvd/files/radvd.service @@ -4,12 +4,23 @@ Documentation=man:radvd(8) After=network.target [Service] +User=radvd +Group=radvd Type=forking -ExecStart=/usr/sbin/radvd --username radvd --logmethod stderr --debug 0 +ExecStartPre=/usr/sbin/radvd --configtest +ExecStart=/usr/sbin/radvd --logmethod stderr --debug 0 ExecReload=/usr/sbin/radvd --configtest ; \ /bin/kill -HUP $MAINPID CPUSchedulingPolicy=idle PIDFile=/run/radvd/radvd.pid +RuntimeDirectory=radvd +CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_RAW +AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=full +ProtectHome=yes +NoNewPrivileges=yes [Install] WantedBy=multi-user.target -- cgit v1.2.3-65-gdbad