use systemd security features

diff --git a/init.d/service.fedora b/init.d/service.fedora
index 0fe6ef6a4fede7c38f6dd5da51289fd0c390dcf9..fdc7bae9617feff8a92cd8c9c66cef7a6e52fca3 100644 (file)
--- a/init.d/service.fedora
+++ b/init.d/service.fedora
@@ -9,6 +9,11 @@ Before=sysinit.target shutdown.target systemd-journald.service
 ExecStart=/usr/sbin/haveged -w 1024 -v 1 --Foreground
 Restart=always
 SuccessExitStatus=137 143
+CapabilityBoundingSet=CAP_SYS_ADMIN
+NoNewPrivileges=on
+PrivateDevices=on
+PrivateNetwork=on
+ProtectSystem=full
 
 [Install]
 WantedBy=sysinit.target