blob: 770295c5460777156f24e56ac2544a85ae371b7b (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
[Unit]
Description=Pacman Prometheus metrics exporter
After=network.target
[Service]
Type=oneshot
EnvironmentFile=/etc/conf.d/prometheus-pacman-exporter
ExecStart=/usr/bin/prometheus-pacman-exporter $PROMETHEUS_PACMAN_EXPORTER_ARGS
User=root
Group=root
# Needs write access to emit the .prom file and read/write the borg cache.
# All other paths read-only by default
ReadWritePaths=/var/lib/prometheus/node-exporter
# Mount a private /tmp not shared with the rest of the system
PrivateTmp=true
# Mount a minimal /dev without the access to raw block or character devices
PrivateDevices=true
# ProtectSystem and ProtectHome are ineffective for root and intentionally omitted
# Hide other processes in /proc
ProtectProc=invisible
# Limit /proc to PID-related files only
ProcSubset=pid
# Set predictable permissions for the written .prom file
UMask=0022
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
# Kernel and system hardening
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectHostname=true
ProtectClock=true
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
RemoveIPC=true
# Capabilites
# Root always holds capabilites, but we restrict what child processes can inherit
CapabilityBoundingSet=CAP_DAC_OVERRIDE
AmbientCapabilities=
NoNewPrivileges=true
# Syscall filtering
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources @mount @swap @reboot
SystemCallFilter=setfsuid setfsgid
[Install]
WantedBy=multi-user.target
|
