blob: 56c3d18da592821897968ce095025dccc8560c9f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
[Unit]
Description=Borgmatic Prometheus metrics exporter
After=network.target
[Service]
Type=oneshot
EnvironmentFile=/etc/conf.d/prometheus-borgmatic-exporter
ExecStart=/usr/bin/prometheus-borgmatic-exporter $PROMETHEUS_BORGMATIC_EXPORTER_ARGS
User=root
Group=root
# Needs write access to emit the .prom file and read/write the borg cache.
# All other paths read-only by default
ReadWritePaths=/var/lib/prometheus/node-exporter
ReadWritePaths=/root/.cache/borg
# Mount a private /tmp not shared with the rest of the system
PrivateTmp=true
# Mount a minimal /dev without the access to raw block or character devices
PrivateDevices=true
# ProtectSystem and ProtectHome are ineffective for root and intentionally omitted
# Hide other processes in /proc
ProtectProc=invisible
# Limit /proc to PID-related files only
ProcSubset=pid
# Set predictable permissions for the written .prom file
UMask=0022
# Restrict to the address families needed for SSH and local communication
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
# Kernel and system hardening
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectHostname=true
ProtectClock=true
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
RemoveIPC=true
# Capabilites
# Root always holds capabilites, but we restrict what child processes can inherit
# CAP_DAC_OVERRIDE: needed by borg for file acess
# CAP_NET_RAW: needed for SSH connections
CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_NET_RAW
AmbientCapabilities=
# NoNewPrivileges is intentionally omitted as borg needs to exec SSH
# Syscall filtering
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources @mount @swap @reboot
[Install]
WantedBy=multi-user.target
|
