26 lines
734 B
Desktop File
26 lines
734 B
Desktop File
[Unit]
|
|
Description=CMPP restricted security execution agent
|
|
After=network.target fail2ban.service nftables.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
Group=cmpp-security
|
|
EnvironmentFile=/etc/cmpp-platform/cmpp-platform.env
|
|
ExecStart=@CMPP_SECURITY_AGENT_BIN@
|
|
Restart=on-failure
|
|
RestartSec=3
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectHome=true
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/run/cmpp-security-agent /var/lib/cmpp-security-agent /etc/nginx/snippets /etc/fail2ban/jail.d
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_KILL
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_DAC_OVERRIDE
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|