From 2b8e86f9c383561e11d21d6d2d61523f04593343 Mon Sep 17 00:00:00 2001
From: Alexandre Aubin <alex.aubin@mailoo.org>
Date: Wed, 11 Nov 2020 16:02:30 +0100
Subject: [PATCH] Update systemd.service

---
 conf/systemd.service | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/conf/systemd.service b/conf/systemd.service
index 76cdf64..803f729 100644
--- a/conf/systemd.service
+++ b/conf/systemd.service
@@ -9,5 +9,22 @@ Group=__APP__
 WorkingDirectory=__FINALPATH__/
 ExecStart=__FINALPATH__/script >> /var/log/__APP__/__APP__.log 2>&1
 
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these 
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+MemoryDenyWriteExecute=yes
+LockPersonality=yes
+
 [Install]
 WantedBy=multi-user.target