diff options
| author | Ahmed AbdelHalim <[email protected]> | 2025-09-10 01:34:21 +0200 |
|---|---|---|
| committer | Ahmed AbdelHalim <[email protected]> | 2025-09-10 02:22:41 +0200 |
| commit | 28ec53a4426210ba60a170aa80de8fe3d9107f4d (patch) | |
| tree | ada31010ad9f53758573501bb644416da23ac046 | |
| parent | b9179506b83c6c3c58a15bf8e379fb9a8bc8e819 (diff) | |
Roulette of disabling service hardening to work on raspberry
| -rw-r--r-- | deployment/wg-portal.service | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/deployment/wg-portal.service b/deployment/wg-portal.service index e68f04c..d83f244 100644 --- a/deployment/wg-portal.service +++ b/deployment/wg-portal.service @@ -17,20 +17,19 @@ TimeoutStartSec=30 TimeoutStopSec=30 # Security hardening -# NoNewPrivileges=true can't work becasue it's needed for sudo wg commands -NoNewPrivileges=false +# The commented hardening options doesn't work on Raspberry PI5 +# NoNewPrivileges=true ProtectSystem=strict ProtectHome=true ReadWritePaths=/etc/wireguard PrivateTmp=true -PrivateDevices=true -# ProtectKernelTunables=true prevents the service from writing to /proc/sys/* paths, sudo wg quick up fails -ProtectKernelTunables=false -ProtectKernelModules=true +# PrivateDevices=true +# ProtectKernelTunables=true +# ProtectKernelModules=true ProtectControlGroups=true -RestrictSUIDSGID=true -RestrictRealtime=true -LockPersonality=true +# RestrictSUIDSGID=true +# RestrictRealtime=true +# LockPersonality=true # Logging StandardOutput=journal |