From: Craig Andrews <candrews@integralblue.com>
Date: Tue, 28 Jun 2016 21:02:41 +0000 (-0400)
Subject: Harden the systemd unit
X-Git-Tag: 16.08~11^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2e28d06744ae0bd2bc5807becc17931520e15b2e;p=ejabberd

Harden the systemd unit

Restrict capabilities, have a private tmp directory, private /dev, and don't accessing file system locations that really shouldn't be accessed.
---

diff --git a/ejabberd.service.template b/ejabberd.service.template
index 80b15adbd..49ba14737 100644
--- a/ejabberd.service.template
+++ b/ejabberd.service.template
@@ -12,6 +12,13 @@ ExecStop=@ctlscriptpath@/ejabberdctl stop
 ExecReload=@ctlscriptpath@/ejabberdctl reload_config
 Type=oneshot
 RemainAfterExit=yes
+# The CAP_DAC_OVERRIDE capability is required for pam authentication to work
+CapabilityBoundingSet=CAP_DAC_OVERRIDE
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=full
+NoNewPrivileges=true
 
 [Install]
 WantedBy=multi-user.target