projects / gentoo.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 4a99c72)
mail-mta/postfix: add systemd hardening
authorRichard Freeman <rich0@gentoo.org>
Sat, 13 Aug 2016 21:03:55 +0000 (17:03 -0400)
committerRichard Freeman <rich0@gentoo.org>
Sat, 13 Aug 2016 21:03:55 +0000 (17:03 -0400)
Package-Manager: portage-2.2.28

mail-mta/postfix/files/postfix.service patch | blob | history

diff --git a/mail-mta/postfix/files/postfix.service b/mail-mta/postfix/files/postfix.service
index d3d4804138b95ee31479c0ab8def40e113854f22..eddd5507ba8eff15164b80886a847a246cd6ffad 100644 (file)
--- a/mail-mta/postfix/files/postfix.service
+++ b/mail-mta/postfix/files/postfix.service
@@ -8,6 +8,12 @@ ExecStartPre=-/usr/bin/newaliases
 ExecStart=/usr/sbin/postfix start
 ExecStop=/usr/sbin/postfix stop
 ExecReload=/usr/sbin/postfix reload
+# Hardening
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=full
+CapabilityBoundingSet=~ CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=multi-user.target
Unnamed repository; edit this file 'description' to name the repository.