diff options
Diffstat (limited to 'deployment/wg-portal.service')
| -rw-r--r-- | deployment/wg-portal.service | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/deployment/wg-portal.service b/deployment/wg-portal.service index e68f04c..d83f244 100644 --- a/deployment/wg-portal.service +++ b/deployment/wg-portal.service @@ -17,20 +17,19 @@ TimeoutStartSec=30 TimeoutStopSec=30 # Security hardening -# NoNewPrivileges=true can't work becasue it's needed for sudo wg commands -NoNewPrivileges=false +# The commented hardening options doesn't work on Raspberry PI5 +# NoNewPrivileges=true ProtectSystem=strict ProtectHome=true ReadWritePaths=/etc/wireguard PrivateTmp=true -PrivateDevices=true -# ProtectKernelTunables=true prevents the service from writing to /proc/sys/* paths, sudo wg quick up fails -ProtectKernelTunables=false -ProtectKernelModules=true +# PrivateDevices=true +# ProtectKernelTunables=true +# ProtectKernelModules=true ProtectControlGroups=true -RestrictSUIDSGID=true -RestrictRealtime=true -LockPersonality=true +# RestrictSUIDSGID=true +# RestrictRealtime=true +# LockPersonality=true # Logging StandardOutput=journal |