mirror of https://github.com/sipwise/mediator.git
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
88 lines
2.4 KiB
88 lines
2.4 KiB
[Unit]
|
|
Description=NGCP Mediator
|
|
After=mariadb.service
|
|
After=remote-fs.target
|
|
Wants=mariadb.service
|
|
|
|
[Service]
|
|
Type=notify
|
|
ExecStart=/usr/bin/ngcp-mediator
|
|
|
|
# Service cannot create writable executable memory mappings that are writable and executable at the same time
|
|
MemoryDenyWriteExecute=true
|
|
|
|
# Service cannot modify the control group file system (via /sys/fs/cgroup)
|
|
ProtectControlGroups=true
|
|
|
|
# Service cannot load or read kernel modules
|
|
ProtectKernelModules=true
|
|
|
|
# Service cannot alter kernel tunables (/proc + /sys)
|
|
ProtectKernelTunables=true
|
|
|
|
# Service may execute system calls only with native ABI
|
|
SystemCallArchitectures=native
|
|
|
|
# Limit set of capabilities
|
|
CapabilityBoundingSet=
|
|
|
|
# Service process does not receive ambient capabilities
|
|
AmbientCapabilities=
|
|
|
|
# Service has no access to other software's temporary files
|
|
PrivateTmp=true
|
|
|
|
# Service has no access to hardware devices
|
|
PrivateDevices=true
|
|
|
|
# Service has no access to home directories
|
|
ProtectHome=true
|
|
|
|
# Service has strict read-only access to the OS file hierarchy
|
|
ProtectSystem=strict
|
|
|
|
# Limit write access
|
|
ReadWritePaths=/run/
|
|
ReadWritePaths=/var/log/ngcp/
|
|
|
|
# Service cannot change ABI personality
|
|
LockPersonality=true
|
|
|
|
# Turn off acquisition of new privileges system-wide
|
|
NoNewPrivileges=true
|
|
|
|
# Service has own user namespace, only root, nobody, and the uid/gid under which the service is running are mapped
|
|
PrivateUsers=true
|
|
|
|
# Service user cannot leave SysV IPC objects around
|
|
# NOTE: service runs as root, so option does not matter
|
|
RemoveIPC=true
|
|
|
|
# Restrict access to the various process namespace types the Linux kernel provides
|
|
RestrictNamespaces=true
|
|
|
|
# Service may not acquire realtime scheduling
|
|
RestrictRealtime=true
|
|
|
|
# Files created by service are accessible only by service's own user by default
|
|
UMask=0077
|
|
|
|
# NOTE: Service needs access to the host's network, to e.g. access redis DB
|
|
PrivateNetwork=false
|
|
|
|
# Control access to specific device nodes by the executed processes
|
|
DevicePolicy=strict
|
|
DeviceAllow=/dev/null rw
|
|
DeviceAllow=/dev/urandom r
|
|
|
|
# Maximum number of bytes of memory that may be locked into RAM
|
|
LimitMEMLOCK=0
|
|
|
|
# Restrict system calls that are allowed to be executed
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@chown @clock @cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @resources @swap memfd_create mincore mlock mlockall personality
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
Alias=mediator.service
|