|
|
@@ -15,3 +15,20 @@ WorkingDirectory=__REPLACEME__/
|
|
|
Restart=always
|
|
|
OOMPolicy=stop
|
|
|
ExecReload=kill -HUP $MAINPID
|
|
|
+AmbientCapabilities=CAP_SYS_RESOURCE CAP_SYS_NICE
|
|
|
+LockPersonality=yes
|
|
|
+MemoryDenyWriteExecute=yes
|
|
|
+OOMPolicy=continue
|
|
|
+PrivateDevices=yes
|
|
|
+PrivateTmp=true
|
|
|
+ProtectClock=yes
|
|
|
+ProtectControlGroups=yes
|
|
|
+ProtectHome=read-only
|
|
|
+ProtectHostname=yes
|
|
|
+ProtectKernelLogs=yes
|
|
|
+ProtectKernelModules=yes
|
|
|
+ProtectKernelTunables=yes
|
|
|
+ProtectSystem=yes
|
|
|
+RestrictNamespaces=yes
|
|
|
+RestrictRealtime=yes
|
|
|
+RestrictSUIDSGID=yes
|
