uuidd: Add hardening settings to uuidd.service

This limits what the uuid daemon has access to when it runs. Further improving this with additional option or making things even tighter is most likely possible. Signed-off-by: Andreas Henriksson <[email protected]>
openfans-community-offical · Nov 29, 2018 · df8d991 · df8d991
1 parent 627a0ef
commit df8d991
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/misc-utils/uuidd.service.in b/misc-utils/uuidd.service.in
@@ -8,6 +8,17 @@ ExecStart=@usrsbin_execdir@/uuidd --socket-activation
 Restart=no
 User=uuidd
 Group=uuidd
+ProtectSystem=strict
+ProtectHome=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+PrivateUsers=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX
+MemoryDenyWriteExecute=yes
+SystemCallFilter=@default @file-system @basic-io @system-service @signal @io-event @network-io
 
 [Install]
 Also=uuidd.socket