enable simple sandboxing on systemd service (#9234)
Yurii Izorkin committed
Jul 20, 2020 at 02:53 UTC
65b83ab2ac2e1a540737be152e32dc2a6bff7936
1 file changed
+17
system/netdata.service.in
+17
@@ -44,5 +44,22 @@ CPUSchedulingPolicy=idle
44
# For scheduling policy 'other' and 'batch', this sets the lowest niceness of netdata (-20 highest to 19 lowest).
45
#Nice=0
46
47
+# Capabilities
48
+CapabilityBoundingSet=CAP_DAC_OVERRIDE # is required for freeipmi and slabinfo plugins
49
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH # is required for apps plugin
50
+CapabilityBoundingSet=CAP_FOWNER # is required for freeipmi plugin
51
+CapabilityBoundingSet=CAP_SETPCAP # is required for apps, perf and slabinfo plugins
52
+CapabilityBoundingSet=CAP_SYS_ADMIN # is required for perf plugin
53
+CapabilityBoundingSet=CAP_SYS_PTRACE # is required for apps plugin
54
+CapabilityBoundingSet=CAP_NET_RAW # is required for fping app
55
+
56
+# Sandboxing
57
+ProtectSystem=full
58
+ProtectHome=read-only
59
+# PrivateTmp break netdatacli functionality. See - https://github.com/netdata/netdata/issues/7587
60
+#PrivateTmp=true
61
+ProtectControlGroups=true
62
+PrivateMounts=true
63
+
64
[Install]
65
WantedBy=multi-user.target