This limits what the uuid daemon has access to when it runs. Further improving this with additional option or making things even tighter is most likely possible. Signed-off-by: Andreas Henriksson <andreas@xxxxxxxx> --- misc-utils/uuidd.service.in | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/misc-utils/uuidd.service.in b/misc-utils/uuidd.service.in index 531672765..dd38b645c 100644 --- a/misc-utils/uuidd.service.in +++ b/misc-utils/uuidd.service.in @@ -7,6 +7,17 @@ ExecStart=@usrsbin_execdir@/uuidd --socket-activation Restart=no User=uuidd Group=uuidd +ProtectSystem=strict +ProtectHome=yes +PrivateDevices=yes +PrivateNetwork=yes +PrivateUsers=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +RestrictAddressFamilies=AF_UNIX +MemoryDenyWriteExecute=yes +SystemCallFilter=@default @file-system @basic-io @system-service @signal @io-event @network-io [Install] Also=uuidd.socket -- 2.19.2
