mail-mta/postfix: additional systemd hardening

Other distributions are doing the same thing, and these additions are recommended by systemd. See https://lwn.net/Articles/709755/ (cherry picked from commit 388f5ca) Signed-off-by: Robin H. Johnson <[email protected]> Fixes: gentoo#3629
hanetzer · Jan 29, 2017 · 6d1bfd6 · 6d1bfd6
1 parent 52021dc
commit 6d1bfd6
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/mail-mta/postfix/files/postfix.service b/mail-mta/postfix/files/postfix.service
@@ -15,6 +15,12 @@ ProtectSystem=full
 ReadWritePaths=-/etc/mail/aliases.db
 CapabilityBoundingSet=~ CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE
 MemoryDenyWriteExecute=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
+RestrictNamespaces=true
+RestrictRealtime=true
 
 [Install]
 WantedBy=multi-user.target