kodev-org
/
vikunja
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(packaging): add systemd security hardening to service

This commit is contained in:
confor 2026-06-28 23:40:15 -04:00 committed by kolaente
parent d2fcd2efa5
commit b947e892d0
1 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
vikunja.service
View File

@ -14,6 +14,34 @@ Type=simple
WorkingDirectory=/opt/vikunja
ExecStart=/usr/local/bin/vikunja
Restart=always
# Hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectHome=yes
ProtectProc=invisible
ProcSubset=pid
UMask=0077
CapabilityBoundingSet=
AmbientCapabilities=
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
PrivateDevices=yes
RestrictNamespaces=yes
RestrictSUIDSGID=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
# If you want to bind Vikunja to a port below 1024 uncomment
# the two values below
###