etc: Add hardening options to syncthing systemd services (fixes #5286) (#5351)

2018-12-07 14:58:12 +01:00
1 parent 002de7b6a0
commit 132789785d
@@ -8,5 +8,12 @@ Restart=on-failure
 SuccessExitStatus=3 4
 RestartForceExitStatus=3 4

+# Hardening
+ProtectSystem=full
+PrivateTmp=true
+SystemCallArchitectures=native
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+
 [Install]
 WantedBy=default.target