oneleet-daemon.service


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

[Unit]
Description=Keeps your computer protected by enforcing secure policies
Documentation=https://docs.oneleet.com/oneleet-agent/setup/
ConditionFileIsExecutable=/opt/Oneleet/oneleet-daemon
StartLimitIntervalSec=5
StartLimitBurst=10

[Service]
Type=simple
User=oneleet
Group=oneleet
AmbientCapabilities=CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_ADMIN
# Keep personal user data outside the daemon's mount namespace.
ProtectHome=true
# Hide Docker's private mount paths from osquery's mount inventory.
InaccessiblePaths=-/run/docker
InaccessiblePaths=-/var/lib/docker
# Explicitly grant the unprivileged daemon read-only access to the private DMI
# files needed for hardware identification.
RuntimeDirectory=oneleet-dmi
RuntimeDirectoryMode=0700
ExecStartPre=-+/usr/bin/install -m 0444 /sys/class/dmi/id/product_uuid /run/oneleet-dmi/product_uuid
ExecStartPre=-+/usr/bin/install -m 0444 /sys/firmware/dmi/tables/DMI /run/oneleet-dmi/dmi_table
BindReadOnlyPaths=-/run/oneleet-dmi/product_uuid:/sys/class/dmi/id/product_uuid
BindReadOnlyPaths=-/run/oneleet-dmi/dmi_table:/sys/firmware/dmi/tables/DMI
# The bundled osquery otherwise falls back to a missing system-wide file and
# logs a misleading configuration error on every survey.
BindReadOnlyPaths=/usr/share/oneleet-agent/osquery.conf:/etc/osquery/osquery.conf
ExecStart=/opt/Oneleet/oneleet-daemon
Restart=always
RestartSec=120
EnvironmentFile=-/etc/sysconfig/oneleet-daemon
ConfigurationDirectory=oneleet
ConfigurationDirectoryMode=0700
LogsDirectory=oneleet
LogsDirectoryMode=0750
StateDirectory=oneleet
StateDirectoryMode=0700

[Install]
WantedBy=multi-user.target