mail-filter/amavisd-new-2.11.0-r2: additional systemd hardening

Gentoo-bug: 587540
Closes: https://github.com/gentoo/gentoo/pull/1797

diff --git a/mail-filter/amavisd-new/amavisd-new-2.11.0-r1.ebuild b/mail-filter/amavisd-new/amavisd-new-2.11.0-r2.ebuild
similarity index 100%
rename from mail-filter/amavisd-new/amavisd-new-2.11.0-r1.ebuild
rename to mail-filter/amavisd-new/amavisd-new-2.11.0-r2.ebuild

diff --git a/mail-filter/amavisd-new/files/amavisd.service b/mail-filter/amavisd-new/files/amavisd.service
index 2a56e443eedd670bf411b3afc4f779e323d20c62..c53c38ac16323f49d7a0edd724d402da5f97fafc 100644 (file)
--- a/mail-filter/amavisd-new/files/amavisd.service
+++ b/mail-filter/amavisd-new/files/amavisd.service
@@ -6,8 +6,17 @@ Wants=clamd.service
 After=network.target
 
 [Service]
+User=amavis
+Group=amavis
 ExecStart=/usr/sbin/amavisd -c /etc/amavisd.conf foreground
 ExecReload=/usr/sbin/amavisd -c /etc/amavisd.conf reload
+PrivateTmp=true
+CapabilityBoundingSet=
+ProtectSystem=full
+NoNewPrivileges=true
+PrivateDevices=true
+ProtectHome=true
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=multi-user.target