From: Craig Andrews <candrews@integralblue.com>
Date: Thu, 30 Jun 2016 15:55:03 +0000 (-0400)
Subject: mail-filter/sqlgrey: systemd .service hardening
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=1a34370c22e9d57dbf10f3830528b19c17704d5d;p=gentoo.git

mail-filter/sqlgrey: systemd .service hardening

Bug: https://bugs.gentoo.org/587596
Closes: https://github.com/gentoo/gentoo/pull/1800
---

diff --git a/mail-filter/sqlgrey/files/sqlgrey.service b/mail-filter/sqlgrey/files/sqlgrey.service
index f6be356b11e7..a3171863e22a 100644
--- a/mail-filter/sqlgrey/files/sqlgrey.service
+++ b/mail-filter/sqlgrey/files/sqlgrey.service
@@ -3,7 +3,20 @@ Description=SQLgrey Postfix Grey-listing Policy service
 After=network.target
 
 [Service]
+User=sqlgrey
+Group=sqlgrey
 ExecStart=/usr/sbin/sqlgrey
+CapabilityBoundingSet=
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=full
+ProtectHome=yes
+NoNewPrivileges=yes
+MemoryDenyWriteExecute=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictRealtime=true
 
 [Install]
 WantedBy=multi-user.target
diff --git a/mail-filter/sqlgrey/sqlgrey-1.7.6-r1.ebuild b/mail-filter/sqlgrey/sqlgrey-1.7.6-r2.ebuild
similarity index 100%
rename from mail-filter/sqlgrey/sqlgrey-1.7.6-r1.ebuild
rename to mail-filter/sqlgrey/sqlgrey-1.7.6-r2.ebuild