systemd sandboxing

This commit is contained in:
Valentin Lorentz 2017-09-18 19:51:13 +02:00
parent b9e29a8eec
commit f7593a1751

View File

@ -101,6 +101,11 @@ following content replacing things were suitable::
Restart=always
User=BOTUSERNAME
SyslogIdentifier=Supybot
# Uncomment these lines for extra security at the cost of breaking some third-party plugins:
# SystemCallFilter=~@raw-io @clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io
# ProtectSystem=strict
# ProtectHome=read-only
# ReadWritePaths=/home/bot/botname
[Install]
WantedBy=multi-user.target