Apply hardening measurements in bitcoind systemd service file
Adds typical systemd hardening measurements for network services.
This commit is contained in:
parent
6acd8700bc
commit
79ddfad486
1 changed files with 19 additions and 0 deletions
|
@ -19,7 +19,26 @@ User=bitcoin
|
|||
Type=forking
|
||||
PIDFile=/run/bitcoind/bitcoind.pid
|
||||
Restart=on-failure
|
||||
|
||||
# Hardening measures
|
||||
####################
|
||||
|
||||
# Provide a private /tmp and /var/tmp.
|
||||
PrivateTmp=true
|
||||
|
||||
# Mount /usr, /boot/ and /etc read-only for the process.
|
||||
ProtectSystem=full
|
||||
|
||||
# Disallow the process and all of its children to gain
|
||||
# new privileges through execve().
|
||||
NoNewPrivileges=true
|
||||
|
||||
# Use a new /dev namespace only populated with API pseudo devices
|
||||
# such as /dev/null, /dev/zero and /dev/random.
|
||||
PrivateDevices=true
|
||||
|
||||
# Deny the creation of writable and executable memory mappings.
|
||||
MemoryDenyWriteExecute=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
Loading…
Reference in a new issue