From: Craig Andrews <candrews@integralblue.com>
Date: Wed, 29 Jun 2016 20:58:13 +0000 (-0400)
Subject: mail-filter/amavisd-new-2.11.0-r2: additional systemd hardening
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=5818e1f7fde117921cbb487e9044bb15f337079c;p=gentoo.git

mail-filter/amavisd-new-2.11.0-r2: additional systemd hardening

Gentoo-bug: 587540
Closes: https://github.com/gentoo/gentoo/pull/1797
---

diff --git a/mail-filter/amavisd-new/amavisd-new-2.11.0-r1.ebuild b/mail-filter/amavisd-new/amavisd-new-2.11.0-r2.ebuild
similarity index 100%
rename from mail-filter/amavisd-new/amavisd-new-2.11.0-r1.ebuild
rename to mail-filter/amavisd-new/amavisd-new-2.11.0-r2.ebuild
diff --git a/mail-filter/amavisd-new/files/amavisd.service b/mail-filter/amavisd-new/files/amavisd.service
index 2a56e443eedd..c53c38ac1632 100644
--- a/mail-filter/amavisd-new/files/amavisd.service
+++ b/mail-filter/amavisd-new/files/amavisd.service
@@ -6,8 +6,17 @@ Wants=clamd.service
 After=network.target
 
 [Service]
+User=amavis
+Group=amavis
 ExecStart=/usr/sbin/amavisd -c /etc/amavisd.conf foreground
 ExecReload=/usr/sbin/amavisd -c /etc/amavisd.conf reload
+PrivateTmp=true
+CapabilityBoundingSet=
+ProtectSystem=full
+NoNewPrivileges=true
+PrivateDevices=true
+ProtectHome=true
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=multi-user.target