blob: 8de7eb6d94835527c686e34edd2e65f75da15e23 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
[Unit]
Description=JupyterHub server
After=network.target
Documentation=https://jupyterhub.readthedocs.io/en/stable/
[Service]
# Where the PID and other runtime files will be placed.
RuntimeDirectory=jupyterhub
RuntimeDirectoryMode=0755
# Paths in the configuration are relative to the working directory.
WorkingDirectory=/etc/jupyterhub
# The actual command to run. Note this service doesn't need the PID files, but
# JupyterHub does use them internally.
ExecStart=/usr/bin/jupyterhub \
-f /etc/jupyterhub/jupyterhub_config.py \
--pid-file=/run/jupyterhub/jupyterhub.pid \
--ConfigurableHTTPProxy.pid_file=/run/jupyterhub/jupyterhub-proxy.pid
# Apply some service hardening.
# The default LocalProcess spawner needs SETUID and SETGID to run the
# single-user servers. For other spawners you could probably remove these.
CapabilityBoundingSet=CAP_SETUID CAP_SETGID
LockPersonality=true
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectClock=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=full
ReadWritePaths=/etc/jupyterhub
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
# Some other hardening that could be enabled for specific setups.
# PrivateUsers=true # Not with LocalSpawner
# MemoryDenyWriteExecute=true # Not with configurable-http-proxy
[Install]
WantedBy=multi-user.target
|