diff options
author | D. Can Celasun | 2020-01-06 08:03:30 +0000 |
---|---|---|
committer | D. Can Celasun | 2020-01-06 08:03:30 +0000 |
commit | 08e2ef3b16279609c7aedf1b2cf584417a01e417 (patch) | |
tree | 173a02d32a65a9e8394bd54263e9a390b57c6152 /bitwarden_rs.service | |
parent | 4f08ddc9816ca9f16c7bf79af66ce8df81c3e186 (diff) | |
download | aur-08e2ef3b16279609c7aedf1b2cf584417a01e417.tar.gz |
[bitwarden_rs-postgresql] Update to 1.13.1
Diffstat (limited to 'bitwarden_rs.service')
-rw-r--r-- | bitwarden_rs.service | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/bitwarden_rs.service b/bitwarden_rs.service index 458600a27ea6..c8263ff33640 100644 --- a/bitwarden_rs.service +++ b/bitwarden_rs.service @@ -14,16 +14,31 @@ ExecStart=/usr/bin/bitwarden_rs # Set reasonable connection and process limits LimitNOFILE=1048576 LimitNPROC=64 -# Isolate bitwarden_rs from the rest of the system + +# Prevent bitwarden_rs from doing anything stupid and/or unneccessary. PrivateTmp=true PrivateDevices=true + ProtectHome=true ProtectSystem=strict +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes + +RestrictNamespaces=yes + +SystemCallArchitectures=native +SystemCallFilter=@system-service +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 + # Only allow writes to the following directory and set it to the working directory (user and password data are stored here) WorkingDirectory=/var/lib/bitwarden_rs ReadWriteDirectories=/var/lib/bitwarden_rs + # Allow bitwarden_rs to bind ports in the range of 0-1024 AmbientCapabilities=CAP_NET_BIND_SERVICE +# Restrict bitwarden_rs to only this capability +CapabilityBoundingSet=CAP_NET_BIND_SERVICE [Install] WantedBy=multi-user.target |