From 5818e1f7fde117921cbb487e9044bb15f337079c Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Wed, 29 Jun 2016 16:58:13 -0400 Subject: [PATCH] mail-filter/amavisd-new-2.11.0-r2: additional systemd hardening Gentoo-bug: 587540 Closes: https://github.com/gentoo/gentoo/pull/1797 --- ...new-2.11.0-r1.ebuild => amavisd-new-2.11.0-r2.ebuild} | 0 mail-filter/amavisd-new/files/amavisd.service | 9 +++++++++ 2 files changed, 9 insertions(+) rename mail-filter/amavisd-new/{amavisd-new-2.11.0-r1.ebuild => amavisd-new-2.11.0-r2.ebuild} (100%) diff --git a/mail-filter/amavisd-new/amavisd-new-2.11.0-r1.ebuild b/mail-filter/amavisd-new/amavisd-new-2.11.0-r2.ebuild similarity index 100% rename from mail-filter/amavisd-new/amavisd-new-2.11.0-r1.ebuild rename to mail-filter/amavisd-new/amavisd-new-2.11.0-r2.ebuild diff --git a/mail-filter/amavisd-new/files/amavisd.service b/mail-filter/amavisd-new/files/amavisd.service index 2a56e443eedd..c53c38ac1632 100644 --- a/mail-filter/amavisd-new/files/amavisd.service +++ b/mail-filter/amavisd-new/files/amavisd.service @@ -6,8 +6,17 @@ Wants=clamd.service After=network.target [Service] +User=amavis +Group=amavis ExecStart=/usr/sbin/amavisd -c /etc/amavisd.conf foreground ExecReload=/usr/sbin/amavisd -c /etc/amavisd.conf reload +PrivateTmp=true +CapabilityBoundingSet= +ProtectSystem=full +NoNewPrivileges=true +PrivateDevices=true +ProtectHome=true +MemoryDenyWriteExecute=true [Install] WantedBy=multi-user.target -- 2.26.2