Improve systemd protections

YunoHost-Apps · Sep 21, 2018 · f9abf64 · f9abf64
1 parent d0bed2f
commit f9abf64
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -25,10 +25,10 @@ Password and other usefull information will be sent to you after installation.
 
 * to be confirmed
   * [x] ARM support
+  * [x] Improve systemd protection
 
 * to be added:
   * [ ] Improve log file and add logrotate
-  * [ ] Improve systemd protection (see: https://github.com/YunoHost-Apps/kresus_ynh/issues/20)
 
 ## Links
 

diff --git a/conf/systemd.service b/conf/systemd.service
@@ -10,6 +10,13 @@ Type=forking
 ExecStart=/usr/sbin/murmurd -ini __FINALPATH__/mumble-server.ini
 PIDFile=/var/run/mumble-server/__APP__.pid
 ExecReload=/bin/kill -s HUP $MAINPID
+PrivateDevices=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ReadWritePaths=__FINALPATH__ /var/log/mumble-server /var/run/mumble-server
 
 [Install]
 WantedBy=multi-user.target
diff --git a/manifest.json b/manifest.json
@@ -15,7 +15,7 @@
     "requirements": {
         "yunohost": ">= 3.1.0"
     },
-    "version": "1.2.8~ynh4",
+    "version": "1.2.8~ynh5",
     "multi_instance": true,
     "services": [
     ],