Update Systemd security settings

cronie-crond · Mar 12, 2024 · d5f98b7 · d5f98b7
1 parent 24e7c0a
commit d5f98b7
Showing 1 changed file with 25 additions and 0 deletions.
diff --git a/contrib/cronie.systemd b/contrib/cronie.systemd
@@ -9,6 +9,31 @@ ExecReload=/bin/kill -URG $MAINPID
 KillMode=process
 Restart=on-failure
 RestartSec=30s
+DevicePolicy=closed
+KeyringMode=private
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=no
+PrivateDevices=yes
+PrivateTmp=yes
+ProcSubset=pid
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+ReadOnlyPaths=/etc/cron.deny
+ReadOnlyPaths=-/etc/sysconfig/cron
+ReadWritePaths=/etc/cron.d/
+ReadWritePaths=/var/spool/cron
+RemoveIPC=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
 
 [Install]
 WantedBy=multi-user.target