mail-filter/sqlgrey: systemd .service hardening

Bug: https://bugs.gentoo.org/587596
Closes: https://github.com/gentoo/gentoo/pull/1800

diff --git a/mail-filter/sqlgrey/files/sqlgrey.service b/mail-filter/sqlgrey/files/sqlgrey.service
index f6be356b11e70ca93afb780a6cb29ededc8c0ffa..a3171863e22aa6958fe909a66daad0f43254d28d 100644 (file)
--- a/mail-filter/sqlgrey/files/sqlgrey.service
+++ b/mail-filter/sqlgrey/files/sqlgrey.service
@@ -3,7 +3,20 @@ Description=SQLgrey Postfix Grey-listing Policy service
 After=network.target
 
 [Service]
+User=sqlgrey
+Group=sqlgrey
 ExecStart=/usr/sbin/sqlgrey
+CapabilityBoundingSet=
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=full
+ProtectHome=yes
+NoNewPrivileges=yes
+MemoryDenyWriteExecute=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictRealtime=true
 
 [Install]
 WantedBy=multi-user.target

diff --git a/mail-filter/sqlgrey/sqlgrey-1.7.6-r1.ebuild b/mail-filter/sqlgrey/sqlgrey-1.7.6-r2.ebuild
similarity index 100%
rename from mail-filter/sqlgrey/sqlgrey-1.7.6-r1.ebuild
rename to mail-filter/sqlgrey/sqlgrey-1.7.6-r2.ebuild