aboutsummaryrefslogtreecommitdiffhomepage
path: root/support/systemd/peertube.service
diff options
context:
space:
mode:
authorRigel Kent <sendmemail@rigelk.eu>2018-12-05 19:39:48 +0100
committerChocobozzz <me@florianbigard.com>2018-12-07 14:14:24 +0100
commit3114c2c2cc1009ac88f043f97927b300710ef29e (patch)
treeb00bcc7ed8b770374faa9ced2fb793cbed144bcb /support/systemd/peertube.service
parent314141279db4826bf4862576b7e0df104834ad00 (diff)
downloadPeerTube-3114c2c2cc1009ac88f043f97927b300710ef29e.tar.gz
PeerTube-3114c2c2cc1009ac88f043f97927b300710ef29e.tar.zst
PeerTube-3114c2c2cc1009ac88f043f97927b300710ef29e.zip
hardening systemd unit
Diffstat (limited to 'support/systemd/peertube.service')
-rw-r--r--support/systemd/peertube.service14
1 files changed, 14 insertions, 0 deletions
diff --git a/support/systemd/peertube.service b/support/systemd/peertube.service
index 88856385c..c1bdcf760 100644
--- a/support/systemd/peertube.service
+++ b/support/systemd/peertube.service
@@ -15,5 +15,19 @@ StandardError=syslog
15SyslogIdentifier=peertube 15SyslogIdentifier=peertube
16Restart=always 16Restart=always
17 17
18; Some security directives.
19; Use private /tmp and /var/tmp folders inside a new file system namespace,
20; which are discarded after the process stops.
21PrivateTmp=true
22; Mount /usr, /boot, and /etc as read-only for processes invoked by this service.
23ProtectSystem=full
24; Sets up a new /dev mount for the process and only adds API pseudo devices
25; like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled
26; by default because it may not work on devices like the Raspberry Pi.
27PrivateDevices=false
28; Ensures that the service process and all its children can never gain new
29; privileges through execve().
30NoNewPrivileges=true
31
18[Install] 32[Install]
19WantedBy=multi-user.target 33WantedBy=multi-user.target