AMajor/SoftEtherVPN
1
0
Fork 0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2024-12-25 17:49:52 +03:00
Code Releases Activity

Added hardening to confine its system capability to what SoftEther requires

Browse Source
This commit is contained in:
Hideki Saito 2015-06-22 10:56:28 -07:00
parent 74795cd42d
commit 73112980b3
No known key found for this signature in database
GPG Key ID: E2083CC3EB0BB919
3 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
systemd/softether-vpnbridge.service
View File

@ -10,6 +10,15 @@ ExecStop=/opt/vpnbridge/vpnbridge stop
KillMode=process
Restart=on-failure
# Hardening
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/opt/vpnbridge
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYS_NICE
[Install]
WantedBy=multi-user.target

8
systemd/softether-vpnclient.service
View File

@ -11,6 +11,14 @@ ExecStop=/opt/vpnclient/vpnclient stop
KillMode=process
Restart=on-failure
# Hardening
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/opt/vpnclient
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYS_NICE
[Install]
WantedBy=multi-user.target

9
systemd/softether-vpnserver.service
View File

@ -11,6 +11,15 @@ ExecStop=/opt/vpnserver/vpnserver stop
KillMode=process
Restart=on-failure
# Hardening
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/opt/vpnserver
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYS_NICE
[Install]
WantedBy=multi-user.target