Harden the netdata systemd service
Netdata runs as the "netdata" user (not root), all capabilities are stripped, a private /tmp is used, and most of the file system is made read only. See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
Craig Andrews committed
Jun 24, 2016 at 16:54 UTC
0ca50e4e41eb2f42a536e0f883d32120c1520e26
1 file changed
+14
-4
system/netdata.service.in
+14
-4
@@ -5,13 +5,23 @@ After=network.target httpd.service squid.service nfs-server.service mysqld.servi
5
[Service]
6
Type=forking
7
WorkingDirectory=/tmp
8
-User=root
9
-Group=root
10
-PIDFile=@localstatedir_POST@/run/netdata.pid
11
-ExecStart=@sbindir_POST@/netdata -P @localstatedir_POST@/run/netdata.pid
8
+User=netdata
9
+Group=netdata
10
+RuntimeDirectory=netdata
11
+PIDFile=@localstatedir_POST@/run/netdata/netdata.pid
12
+ExecStart=@sbindir_POST@/netdata -P @localstatedir_POST@/run/netdata/netdata.pid
13
KillMode=mixed
14
KillSignal=SIGTERM
15
TimeoutStopSec=30
16
17
+#Hardening
18
+AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
19
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
20
+PrivateTmp=true
21
+ProtectSystem=full
22
+ProtectHome=read-only
23
+#NoNewPrivileges=true is implicitly set by the MemoryDenyWriteExecute=true
24
+MemoryDenyWriteExecute=true
25
+
26
[Install]
27
WantedBy=multi-user.target