Browse Source

scripts: add NoNewPrivileges=true to systemd unit file (#5381)

Also add comment about unsupported options in different systemd versions.
pull/5388/head
Steven Haigh 6 years ago committed by 无闻
parent
commit
3c227af508
  1. 5
      scripts/systemd/gogs.service

5
scripts/systemd/gogs.service

@ -18,10 +18,13 @@ WorkingDirectory=/home/git/gogs
ExecStart=/home/git/gogs/gogs web ExecStart=/home/git/gogs/gogs web
Restart=always Restart=always
Environment=USER=git HOME=/home/git Environment=USER=git HOME=/home/git
# Hardening
# Some distributions may not support these hardening directives. If you cannot start the service due
# to an unknown option, comment out the ones not supported by your version of systemd.
ProtectSystem=full ProtectSystem=full
PrivateDevices=yes PrivateDevices=yes
PrivateTmp=yes PrivateTmp=yes
NoNewPrivileges=true
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

Loading…
Cancel
Save