disable capabilities at systemd.service; #773
Costa Tsaousis committed
Aug 14, 2016 at 16:11 UTC
ca3e367aeb9065828c656ed45bf78661222e7d90
1 file changed
+5
-2
system/netdata.service.in
+5
-2
@@ -28,8 +28,11 @@ SendSIGKILL=no
28
# -----------------------------------------------------------------------------
29
# Hardening netdata
30
31
-AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
32
-CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
31
+# These will apply these capabilities to the entire netdata process tree
32
+# We don't want this - only apps.plugin needs them
33
+# AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
34
+# CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
35
+
36
PrivateTmp=true
37
ProtectSystem=full
38
ProtectHome=read-only