From 28ec53a4426210ba60a170aa80de8fe3d9107f4d Mon Sep 17 00:00:00 2001
From: Ahmed AbdelHalim <pm@a14m.me>
Date: Wed, 10 Sep 2025 01:34:21 +0200
Subject: Roulette of disabling service hardening to work on raspberry

---
 deployment/wg-portal.service | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

(limited to 'deployment')

diff --git a/deployment/wg-portal.service b/deployment/wg-portal.service
index e68f04c..d83f244 100644
--- a/deployment/wg-portal.service
+++ b/deployment/wg-portal.service
@@ -17,20 +17,19 @@ TimeoutStartSec=30
 TimeoutStopSec=30
 
 # Security hardening
-# NoNewPrivileges=true can't work becasue it's needed for sudo wg commands
-NoNewPrivileges=false
+# The commented hardening options doesn't work on Raspberry PI5
+# NoNewPrivileges=true
 ProtectSystem=strict
 ProtectHome=true
 ReadWritePaths=/etc/wireguard
 PrivateTmp=true
-PrivateDevices=true
-# ProtectKernelTunables=true prevents the service from writing to /proc/sys/* paths, sudo wg quick up fails
-ProtectKernelTunables=false
-ProtectKernelModules=true
+# PrivateDevices=true
+# ProtectKernelTunables=true
+# ProtectKernelModules=true
 ProtectControlGroups=true
-RestrictSUIDSGID=true
-RestrictRealtime=true
-LockPersonality=true
+# RestrictSUIDSGID=true
+# RestrictRealtime=true
+# LockPersonality=true
 
 # Logging
 StandardOutput=journal
-- 
cgit v1.2.3