systemd service: disallow access to devices (except, zero, full, null…

…, random, urandom)
PowerDNS · Dec 7, 2022 · a4e4a9d · a4e4a9d
1 parent 77a8401
commit a4e4a9d
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 0 deletions.
diff --git a/pdns/dnsdistdist/dnsdist.service.in b/pdns/dnsdistdist/dnsdist.service.in
@@ -54,6 +54,7 @@ ProtectProc=invisible
 MemoryDenyWriteExecute=true
 PrivateIPC=true
 RemoveIPC=true
+DevicePolicy=closed
 
 [Install]
 WantedBy=multi-user.target
diff --git a/pdns/ixfrdist.service.in b/pdns/ixfrdist.service.in
@@ -38,6 +38,7 @@ ProtectProc=invisible
 MemoryDenyWriteExecute=true
 PrivateIPC=true
 RemoveIPC=true
+DevicePolicy=closed
 
 [Install]
 WantedBy=multi-user.target
diff --git a/pdns/pdns.service.in b/pdns/pdns.service.in
@@ -44,6 +44,7 @@ ProtectProc=invisible
 MemoryDenyWriteExecute=true
 PrivateIPC=true
 RemoveIPC=true
+DevicePolicy=closed
 
 [Install]
 WantedBy=multi-user.target
diff --git a/pdns/recursordist/pdns-recursor.service.in b/pdns/recursordist/pdns-recursor.service.in
@@ -45,6 +45,7 @@ ProtectProc=invisible
 MemoryDenyWriteExecute=true
 PrivateIPC=true
 RemoveIPC=true
+DevicePolicy=closed
 
 [Install]
 WantedBy=multi-user.target