mirror of
https://github.com/HorlogeSkynet/systemd-hardene.d.git
synced 2026-08-25 00:00:25 +02:00
HorlogeSkynet
81fd48eaf2
Note : on distributions packaging each PostgreSQL version as `postgresql-${version}.service`
systemd units (and not `postgresql@${version}-${cluster}.service`), an additional install
step will be required.
For instance :
ln -s /usr/local/share/systemd-hardene.d/collection/postgresql@.service.d /usr/local/lib/systemd/system/postgresql-17.service.d
35 lines
744 B
Plaintext
35 lines
744 B
Plaintext
[Service]
|
|
CapabilityBoundingSet=CAP_CHOWN CAP_SETUID CAP_SETGID
|
|
|
|
MemoryDenyWriteExecute=yes
|
|
|
|
NoNewPrivileges=yes
|
|
|
|
PrivateBPF=yes
|
|
PrivateDevices=yes
|
|
PrivateIPC=yes
|
|
PrivateMounts=yes
|
|
PrivateTmp=yes
|
|
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=noaccess
|
|
ProcSubset=pid
|
|
ProtectSystem=strict
|
|
ReadWritePaths=-/run/postgresql -/var/cache/postgresql -/var/lib/postgresql -/var/log/postgresql
|
|
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
|
|
LockPersonality=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@resources memfd_create
|