Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Harden example service #30

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Harden example service #30

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 43 additions & 9 deletions go-mmproxy.service.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,20 +3,54 @@ Description=go-mmproxy
After=network.target

[Service]
Type=simple
User=go-mmproxy
Group=go-mmproxy

LimitNOFILE=65535
ExecStartPost=/sbin/ip rule add from 127.0.0.1/8 iif lo table 123
ExecStartPost=/sbin/ip route add local 0.0.0.0/0 dev lo table 123
ExecStartPost=/sbin/ip -6 rule add from ::1/128 iif lo table 123
ExecStartPost=/sbin/ip -6 route add local ::/0 dev lo table 123

ExecStartPost=+/sbin/ip rule add from 127.0.0.1/8 iif lo table 123
ExecStartPost=+/sbin/ip route add local 0.0.0.0/0 dev lo table 123
ExecStartPost=+/sbin/ip -6 rule add from ::1/128 iif lo table 123
ExecStartPost=+/sbin/ip -6 route add local ::/0 dev lo table 123

ExecStart=/usr/bin/go-mmproxy -4 127.0.0.1:1000 -6 "[::1]:1000" -allowed-subnets /usr/share/path-prefixes.txt -l 0.0.0.0:1234
ExecStopPost=/sbin/ip rule del from 127.0.0.1/8 iif lo table 123
ExecStopPost=/sbin/ip route del local 0.0.0.0/0 dev lo table 123
ExecStopPost=/sbin/ip -6 rule del from ::1/128 iif lo table 123
ExecStopPost=/sbin/ip -6 route del local ::/0 dev lo table 123

ExecStopPost=+/sbin/ip rule del from 127.0.0.1/8 iif lo table 123
ExecStopPost=+/sbin/ip route del local 0.0.0.0/0 dev lo table 123
ExecStopPost=+/sbin/ip -6 rule del from ::1/128 iif lo table 123
ExecStopPost=+/sbin/ip -6 route del local ::/0 dev lo table 123

Restart=on-failure
RestartSec=10s

AmbientCapabilities=CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_ADMIN

KeyringMode=private
LockPersonality=yes
MemoryDenyWriteExecute=yes
MountFlags=private
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
ProcSubset=pid
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=yes
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@basic-io @file-system @io-event @ipc @network-io @process @signal madvise setrlimit splice

[Install]
WantedBy=multi-user.target