From 80f094370d5e5c11c8f5eb3bde48710403309261 Mon Sep 17 00:00:00 2001 From: Richard Freeman Date: Sat, 13 Aug 2016 17:03:55 -0400 Subject: [PATCH] mail-mta/postfix: add systemd hardening Package-Manager: portage-2.2.28 --- mail-mta/postfix/files/postfix.service | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mail-mta/postfix/files/postfix.service b/mail-mta/postfix/files/postfix.service index d3d4804138b9..eddd5507ba8e 100644 --- a/mail-mta/postfix/files/postfix.service +++ b/mail-mta/postfix/files/postfix.service @@ -8,6 +8,12 @@ ExecStartPre=-/usr/bin/newaliases ExecStart=/usr/sbin/postfix start ExecStop=/usr/sbin/postfix stop ExecReload=/usr/sbin/postfix reload +# Hardening +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=full +CapabilityBoundingSet=~ CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE +MemoryDenyWriteExecute=true [Install] WantedBy=multi-user.target -- 2.26.2