Tomster/Linux-Setup-Scripts
1
0
Fork 0
mirror of https://github.com/tommytran732/Linux-Setup-Scripts synced 2024-11-09 11:41:33 -05:00
Code

Improve unbound systemd hardening

Browse Source 
Signed-off-by: Tommy <contact@tommytran.io>
This commit is contained in:
Tommy 2024-06-26 12:12:54 -07:00
parent af99058f4e
commit c2ef5743a2
Signed by: Tomster
GPG Key ID: 555C902A34EC968F
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
etc/systemd/system/unbound.service.d/override-chroot.conf
View File

@ -10,9 +10,10 @@ ProtectControlGroups=true
ProtectKernelLogs=true ProtectKernelLogs=true
ProtectKernelModules=true ProtectKernelModules=true
# This breaks using socket options like 'so-rcvbuf'. Explicitly disable for visibility. # This breaks using socket options like 'so-rcvbuf'. Explicitly disable for visibility.
ProtectKernelTunables=false ProtectKernelTunables=true
ProtectProc=invisible ProtectProc=invisible
#ProtectSystem=strict # ProtectSystem with strict does not work - need further testing.
ProtectSystem=full
#RuntimeDirectory=unbound #RuntimeDirectory=unbound
#ConfigurationDirectory=unbound #ConfigurationDirectory=unbound
#StateDirectory=unbound #StateDirectory=unbound

3
etc/systemd/system/unbound.service.d/override.conf
View File

@ -12,7 +12,8 @@ ProtectKernelModules=true
# This breaks using socket options like 'so-rcvbuf'. # This breaks using socket options like 'so-rcvbuf'.
ProtectKernelTunables=true ProtectKernelTunables=true
ProtectProc=invisible ProtectProc=invisible
#ProtectSystem=strict # ProtectSystem with strict does not work - need further testing.
ProtectSystem=full
#RuntimeDirectory=unbound #RuntimeDirectory=unbound
#ConfigurationDirectory=unbound #ConfigurationDirectory=unbound
#StateDirectory=unbound #StateDirectory=unbound