From: Craig Andrews <candrews@integralblue.com>
Date: Tue, 24 Jan 2017 17:39:20 +0000 (-0500)
Subject: mail-mta/postfix: additional systemd hardening
X-Git-Url: http://git.tremily.us/gitweb.cgi?a=commitdiff_plain;h=6d1bfd687106fcb4a75e0d225d77153f2b9c581d;p=gentoo.git

mail-mta/postfix: additional systemd hardening

Other distributions are doing the same thing, and these additions are recommended by systemd. See https://lwn.net/Articles/709755/

(cherry picked from commit 388f5cae8b89039f285a66651bc70d662a9d8e57)
Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
Fixes: https://github.com/gentoo/gentoo/pull/3629
---

diff --git a/mail-mta/postfix/files/postfix.service b/mail-mta/postfix/files/postfix.service
index 585849e978b3..db585b3e29db 100644
--- a/mail-mta/postfix/files/postfix.service
+++ b/mail-mta/postfix/files/postfix.service
@@ -15,6 +15,12 @@ ProtectSystem=full
 ReadWritePaths=-/etc/mail/aliases.db
 CapabilityBoundingSet=~ CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE
 MemoryDenyWriteExecute=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
+RestrictNamespaces=true
+RestrictRealtime=true
 
 [Install]
 WantedBy=multi-user.target