From 1a341543ba155e3b4416368344cbb705690aceca Mon Sep 17 00:00:00 2001
From: Paul van Tilburg <paul@luon.net>
Date: Fri, 13 Nov 2020 21:37:22 +0100
Subject: Lock down the Conduit process in the systemd unit

This will secure the service more and allow only what is necessary.
---
 debian/matrix-conduit.service | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

(limited to 'debian')

diff --git a/debian/matrix-conduit.service b/debian/matrix-conduit.service
index 42969c1..5ab7917 100644
--- a/debian/matrix-conduit.service
+++ b/debian/matrix-conduit.service
@@ -7,6 +7,33 @@ User=_matrix-conduit
 Group=_matrix-conduit
 Type=simple
 
+AmbientCapabilities=
+CapabilityBoundingSet=
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=strict
+PrivateDevices=yes
+PrivateMounts=yes
+PrivateTmp=yes
+PrivateUsers=yes
+RemoveIPC=yes
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+StateDirectory=matrix-conduit
+
 Environment="ROCKET_ENV=production"
 Environment="ROCKET_DATABASE_PATH=/var/lib/matrix-conduit"
 EnvironmentFile=/etc/matrix-conduit/debian
-- 
cgit v1.2.3