mail-mta/postfix: additional systemd hardening

Other distributions are doing the same thing, and these additions are recommended by systemd. See https://lwn.net/Articles/709755/

(cherry picked from commit 388f5cae8b89039f285a66651bc70d662a9d8e57)
Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
Fixes: https://github.com/gentoo/gentoo/pull/3629

diff --git a/mail-mta/postfix/files/postfix.service b/mail-mta/postfix/files/postfix.service
index 585849e978b3d0e5f7eb99a2db5e342aec3c806c..db585b3e29dbebfc92f4417c2349212b5cbbee3e 100644 (file)
--- a/mail-mta/postfix/files/postfix.service
+++ b/mail-mta/postfix/files/postfix.service
@@ -15,6 +15,12 @@ ProtectSystem=full
 ReadWritePaths=-/etc/mail/aliases.db
 CapabilityBoundingSet=~ CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE
 MemoryDenyWriteExecute=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
+RestrictNamespaces=true
+RestrictRealtime=true
 
 [Install]
 WantedBy=multi-user.target