summarylogtreecommitdiffstats
path: root/appgatedriver.service
diff options
context:
space:
mode:
authorPawel Mosakowski2018-07-19 12:54:14 +0100
committerPawel Mosakowski2018-07-19 13:04:27 +0100
commit4d66e166bfcd9d805d242d02082c146e5af73d24 (patch)
treea4a5057991bf730ab42f6ea09cb45ef04fcbec7e /appgatedriver.service
downloadaur-4d66e166bfcd9d805d242d02082c146e5af73d24.tar.gz
Initial release
Diffstat (limited to 'appgatedriver.service')
-rw-r--r--appgatedriver.service29
1 files changed, 29 insertions, 0 deletions
diff --git a/appgatedriver.service b/appgatedriver.service
new file mode 100644
index 00000000000..902db9a64f2
--- /dev/null
+++ b/appgatedriver.service
@@ -0,0 +1,29 @@
+[Unit]
+Description=AppGate driver service
+
+[Service]
+# Remove traces of appgate-resolver, if it wasn't terminated properly
+ExecStartPre=/bin/sh -c "test -e /etc/resolv.appgate && (chattr -i /etc/resolv.conf || :; mv /etc/resolv.appgate /etc/resolv.conf) ||:"
+ExecStart="/opt/appgate/tun-service"
+Type=forking
+Restart=always
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+PrivateTmp=true
+CapabilityBoundingSet=~CAP_SYS_ADMIN
+CapabilityBoundingSet=~CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYSLOG
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_SYS_TIME
+CapabilityBoundingSet=~CAP_SYS_RESOURCE
+CapabilityBoundingSet=~CAP_SYS_PTRACE
+CapabilityBoundingSet=~CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_SYS_MODULE
+CapabilityBoundingSet=~CAP_SYS_CHROOT
+CapabilityBoundingSet=~CAP_SYS_BOOT
+InaccessiblePaths=-/mnt -/srv -/boot -/media
+
+[Install]
+WantedBy=multi-user.target