From: Richard Freeman <rich0@gentoo.org>
Date: Sat, 13 Aug 2016 21:03:55 +0000 (-0400)
Subject: mail-mta/postfix: add systemd hardening
X-Git-Url: http://git.tremily.us/gitweb.cgi?a=commitdiff_plain;h=80f094370d5e5c11c8f5eb3bde48710403309261;p=gentoo.git

mail-mta/postfix: add systemd hardening

Package-Manager: portage-2.2.28
---

diff --git a/mail-mta/postfix/files/postfix.service b/mail-mta/postfix/files/postfix.service
index d3d4804138b9..eddd5507ba8e 100644
--- a/mail-mta/postfix/files/postfix.service
+++ b/mail-mta/postfix/files/postfix.service
@@ -8,6 +8,12 @@ ExecStartPre=-/usr/bin/newaliases
 ExecStart=/usr/sbin/postfix start
 ExecStop=/usr/sbin/postfix stop
 ExecReload=/usr/sbin/postfix reload
+# Hardening
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=full
+CapabilityBoundingSet=~ CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=multi-user.target