better example file for systemd service #22
Conversation
| User=nobody | ||
| Group=nogroup | ||
| Environment=USER=nobody HOME=/tmp | ||
| ProtectSystem=true |
There was a problem hiding this comment.
this should be ProtectSystem=full so that a config file with allowed subnets can be loaded from /etc
There was a problem hiding this comment.
It should be strict, as the service does not need any write access.
There was a problem hiding this comment.
It should be
strict, as the service does not need any write access.
Yes, you are right.
When using DynamicUser=yes systemd also implicitly sets ProtectSystem=strict according to the systemd documentation.
| Restart=on-failure | ||
| RestartSec=10s | ||
| User=nobody | ||
| Group=nogroup |
There was a problem hiding this comment.
User and Group should not be set to nobody/nogroup, instead DynamicUser=yes should be used
|
@cs8425 I'm happy to merge this if you include @DanScharon's comments |
|
I'm proposing an alternative patch, including the suggestions along with more hardening options: #30. |
drop root permission on
go-mmproxyitself,enable
CAP_NET_BIND_SERVICE,CAP_NET_ADMINfor binding < 1024 port and usingIP_TRANSPARENT,and keep
ip rule,ip routeworking.