diff options
| author | Leitwolf | 2026-11-13 05:06:08 +0300 |
|---|---|---|
| committer | GitHub | 2026-11-13 05:06:08 +0300 |
| commit | d82258f9f3bb23a0f59d79b984ff527942efc0f0 (patch) | |
| tree | da8b19d9dbe959d85ab60b044295b3c1afb8cc3a /ops/git/systemd/fcgiwrap@cgit.service.d/hardening.conf | |
| parent | 189b15ca0909033a40626bc8f600686e561b9cbb (diff) | |
| parent | f980fee24c5302173fa00ab758b7c54213d2bb7a (diff) | |
| download | progmaweb-content/catalog-without-tala.tar.gz | |
Merge branch 'main' into content/catalog-without-talacontent/catalog-without-tala
Diffstat (limited to 'ops/git/systemd/fcgiwrap@cgit.service.d/hardening.conf')
| -rw-r--r-- | ops/git/systemd/fcgiwrap@cgit.service.d/hardening.conf | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/ops/git/systemd/fcgiwrap@cgit.service.d/hardening.conf b/ops/git/systemd/fcgiwrap@cgit.service.d/hardening.conf new file mode 100644 index 0000000..5f5b94f --- /dev/null +++ b/ops/git/systemd/fcgiwrap@cgit.service.d/hardening.conf @@ -0,0 +1,37 @@ +# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> +# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1 + +# cgit and git-http-backend read the mirrors and write only the cache of cgit; they reach no +# network and keep no rights of their own. +# +# fcgiwrap runs in httpd_t (/usr/bin/fcgiwrap is httpd_exec_t), so Nginx may connect to it, and +# cgit and git-http-backend move into git_script_t; the module in ../selinux allows that move under +# NoNewPrivileges. +[Service] +NoNewPrivileges=yes +ProtectSystem=strict +ReadWritePaths=/var/cache/cgit +ProtectHome=yes +PrivateTmp=yes +PrivateDevices=yes +PrivateNetwork=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectKernelLogs=yes +ProtectControlGroups=yes +ProtectClock=yes +ProtectHostname=yes +ProtectProc=invisible +ProcSubset=pid +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +MemoryDenyWriteExecute=yes +SystemCallArchitectures=native +SystemCallFilter=@system-service +SystemCallFilter=~@privileged @resources +CapabilityBoundingSet= +AmbientCapabilities= +UMask=0077 |