diff --git a/log2ram.service b/log2ram.service index 3dc8a22..1d6ba23 100644 --- a/log2ram.service +++ b/log2ram.service @@ -15,13 +15,13 @@ ExecReload= /usr/local/bin/log2ram write TimeoutStartSec=120 RemainAfterExit=yes -#SANDBOXING# -- partly tested +# SANDBOXING LockPersonality=true MemoryDenyWriteExecute=true NoNewPriviliges=true PrivateDevices=true PrivateNetwork=true - #Will likely break "MAIL" in log2ram.config if does not point to localhost / disabled + #Will likely break "MAIL" in log2ram.config if does not point to localhost or is unused. ProtectClock=true ProtectControlGroups=true ProtectHostname=true @@ -35,8 +35,5 @@ ProtectHome=true #will likely break situations wherein configured to also copy logs from $HOME. #can probably fix with systemctl edit to whitelist relevant dirs - - - [Install] WantedBy=sysinit.target