From 26395cd3595db1988fa64d7c8c0bc814c6631548 Mon Sep 17 00:00:00 2001
From: Sven-Hendrik Haase <svenstaro@gmail.com>
Date: Sun, 18 Apr 2021 09:27:57 +0200
Subject: Add hardened systemd unit file

---
 packaging/miniserve@.service | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 packaging/miniserve@.service

(limited to 'packaging/miniserve@.service')

diff --git a/packaging/miniserve@.service b/packaging/miniserve@.service
new file mode 100644
index 0000000..9dc5fe0
--- /dev/null
+++ b/packaging/miniserve@.service
@@ -0,0 +1,28 @@
+[Unit]
+Description=miniserve for %i
+After=network-online.target
+Wants=network-online.target systemd-networkd-wait-online.service
+
+[Service]
+ExecStart=/usr/bin/miniserve -- %I
+
+IPAccounting=yes
+IPAddressAllow=localhost
+IPAddressDeny=any
+DynamicUser=yes
+PrivateTmp=yes
+PrivateUsers=yes
+PrivateDevices=yes
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.3