Return back ProtectSystem to strict, and enable access to
/var/lib/libuuid only.
Note: As LIBUUID_CLOCK_FILE does not use @localstatedir@, we use
/var here as well.
Signed-off-by: Ali Abdallah <ali.abdallah@xxxxxxxx>
Signed-off-by: Stanislav Brabec <sbrabec@xxxxxxx>
---
misc-utils/uuidd.service.in | 2 ++
1 file changed, 2 insertions(+)
diff --git a/misc-utils/uuidd.service.in b/misc-utils/uuidd.service.in
index 065b4a194..e64ca59b5 100644
--- a/misc-utils/uuidd.service.in
+++ b/misc-utils/uuidd.service.in
@@ -8,6 +8,7 @@ ExecStart=@usrsbin_execdir@/uuidd --socket-activation
Restart=no
User=uuidd
Group=uuidd
+ProtectSystem=strict
ProtectHome=yes
PrivateDevices=yes
PrivateNetwork=yes
@@ -17,6 +18,7 @@ ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX
MemoryDenyWriteExecute=yes
+ReadWritePaths=/var/lib/libuuid/
SystemCallFilter=@default @file-system @basic-io @system-service
@signal @io-event @network-io
[Install]
--
2.34.1
--
Best Regards / S pozdravem,
Stanislav Brabec
software developer
---------------------------------------------------------------------
SUSE LINUX, s. r. o. e-mail: sbrabec@xxxxxxxx
Křižíkova 148/34 (Corso IIa) tel: +420 284 084 060
186 00 Praha 8-Karlín fax: +420 284 084 001
Czech Republic http://www.suse.cz/
PGP: 830B 40D5 9E05 35D8 5E27 6FA3 717C 209F A04F CD76
