Clément Michaud clems4ever

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

	{
	"name": "authelia",
	"version": "3.7.1",
	"lockfileVersion": 1,
	"requires": true,
	"dependencies": {
	"@sinonjs/formatio": {
	"version": "2.0.0",
	"resolved": "https://registry.npmjs.org/@sinonjs/formatio/-/formatio-2.0.0.tgz",
	"integrity": "sha512-ls6CAMA6/5gG+O/IdsBcblvnd8qcO/l1TYoNeAzp3wcISOxlPXQEus0mLcdwazEkWjaBdaJ3TaxmNgCLWwvWzg==",

	from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
	import os

	class MyHandler(BaseHTTPRequestHandler):
	def do_GET(self):
	self.send_response(200)
	self.send_header('Content-type', 'text/html')
	self.end_headers()
	self.wfile.write('<html><head><title>Hello Criteo</title></head><body><h1>Hello Criteo!</h1></body></html>')
	def log_message(self, format, *args):

	[Unit]
	Description=Public filter enforcement Service

	[Service]
	Type=simple
	ExecStart=/home/user/custom-chain-enforcement.sh
	KillMode=mixed

	TimeoutStartSec=0
	RestartSec=0

	---
	- name: Check if network {{ name }} exists
	delegate_to: "{{ groups['docker_swarm_issuer'][0] }}"
	run_once: true
	command: docker network ls -q --filter name=^{{ name }}$
	register: network_exists
	changed_when: false

	- name: Create network {{ name }}
	command: docker network create --driver {{ driver }} {{ name }}