mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-02-06 17:21:41 +07:00
Code Issues Packages Projects Releases Wiki Activity

re-enable PrivateNetwork=true

Browse Source
This commit is contained in:
Patrick Schleizer 2019-07-01 14:53:01 +00:00
parent 81b38529d9
commit f82731698c
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/systemd/system/proc-hidepid.service
View File

@ -11,6 +11,7 @@ After=local-fs.target
Type=oneshot Type=oneshot
ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
## Disabled since not working in Qubes.
#ProtectSystem=strict #ProtectSystem=strict
#ProtectHome=true #ProtectHome=true
#ProtectKernelTunables=true #ProtectKernelTunables=true
@ -19,7 +20,6 @@ ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
#PrivateTmp=true #PrivateTmp=true
#PrivateMounts=true #PrivateMounts=true
#PrivateDevices=true #PrivateDevices=true
#PrivateNetwork=true
#MemoryDenyWriteExecute=true #MemoryDenyWriteExecute=true
#NoNewPrivileges=true #NoNewPrivileges=true
#RestrictRealtime=true #RestrictRealtime=true
@ -27,5 +27,7 @@ ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
#RestrictNamespaces=true #RestrictNamespaces=true
#SystemCallFilter=mount munmap access read open close stat fstat lstat mmap mprotect brk rt_sigaction rt_sigprocmask execve readlink getrlimit getuid getgid geteuid getegid statfs prctl arch_prctl set_tid_address newfstatat set_robust_list openat mkdir #SystemCallFilter=mount munmap access read open close stat fstat lstat mmap mprotect brk rt_sigaction rt_sigprocmask execve readlink getrlimit getuid getgid geteuid getegid statfs prctl arch_prctl set_tid_address newfstatat set_robust_list openat mkdir
PrivateNetwork=true
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target