diff options
| -rw-r--r-- | deployment/wg-portal.service | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/deployment/wg-portal.service b/deployment/wg-portal.service index 23d9dad..e68f04c 100644 --- a/deployment/wg-portal.service +++ b/deployment/wg-portal.service @@ -17,13 +17,15 @@ TimeoutStartSec=30 TimeoutStopSec=30 # Security hardening -NoNewPrivileges=true +# NoNewPrivileges=true can't work becasue it's needed for sudo wg commands +NoNewPrivileges=false ProtectSystem=strict ProtectHome=true ReadWritePaths=/etc/wireguard PrivateTmp=true PrivateDevices=true -ProtectKernelTunables=true +# ProtectKernelTunables=true prevents the service from writing to /proc/sys/* paths, sudo wg quick up fails +ProtectKernelTunables=false ProtectKernelModules=true ProtectControlGroups=true RestrictSUIDSGID=true |