|
|
@ -19,6 +19,8 @@ StartLimitIntervalSec=60s
|
|
|
|
User=pihole
|
|
|
|
User=pihole
|
|
|
|
PermissionsStartOnly=true
|
|
|
|
PermissionsStartOnly=true
|
|
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_NICE CAP_IPC_LOCK CAP_CHOWN
|
|
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_NICE CAP_IPC_LOCK CAP_CHOWN
|
|
|
|
|
|
|
|
# Prevents the pihole-FTL process from acquiring more capabilities then the following
|
|
|
|
|
|
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_NICE CAP_IPC_LOCK CAP_CHOWN
|
|
|
|
|
|
|
|
|
|
|
|
ExecStartPre=/opt/pihole/pihole-FTL-prestart.sh
|
|
|
|
ExecStartPre=/opt/pihole/pihole-FTL-prestart.sh
|
|
|
|
ExecStart=/usr/bin/pihole-FTL -f
|
|
|
|
ExecStart=/usr/bin/pihole-FTL -f
|
|
|
@ -30,12 +32,44 @@ ExecStopPost=/opt/pihole/pihole-FTL-poststop.sh
|
|
|
|
# Use graceful shutdown with a reasonable timeout
|
|
|
|
# Use graceful shutdown with a reasonable timeout
|
|
|
|
TimeoutStopSec=10s
|
|
|
|
TimeoutStopSec=10s
|
|
|
|
|
|
|
|
|
|
|
|
# Make /usr, /boot, /etc and possibly some more folders read-only...
|
|
|
|
# Let the pihole-FTL process see a read-only view of /opt/pihole when TemporaryFileSystem= is
|
|
|
|
ProtectSystem=full
|
|
|
|
# hiding the content of /opt
|
|
|
|
# ... except /etc/pihole
|
|
|
|
BindReadOnlyPaths=/opt/pihole
|
|
|
|
# This merely retains r/w access rights, it does not add any new.
|
|
|
|
# Gives access to /etc/pihole
|
|
|
|
# Must still be writable on the host!
|
|
|
|
ConfigurationDirectory=pihole
|
|
|
|
ReadWriteDirectories=/etc/pihole
|
|
|
|
LockPersonality=true
|
|
|
|
|
|
|
|
# Gives access to /var/log/pihole
|
|
|
|
|
|
|
|
LogsDirectory=pihole
|
|
|
|
|
|
|
|
NoNewPrivileges=true
|
|
|
|
|
|
|
|
PrivateDevices=true
|
|
|
|
|
|
|
|
PrivateIPC=true
|
|
|
|
|
|
|
|
# Gives pihole-FTL a private (0700), not shared, per-execution, tmp folder
|
|
|
|
|
|
|
|
PrivateTmp=true
|
|
|
|
|
|
|
|
ProtectClock=true
|
|
|
|
|
|
|
|
ProtectControlGroups=true
|
|
|
|
|
|
|
|
ProtectHome=true
|
|
|
|
|
|
|
|
ProtectHostname=true
|
|
|
|
|
|
|
|
ProtectKernelLogs=true
|
|
|
|
|
|
|
|
ProtectKernelModules=true
|
|
|
|
|
|
|
|
ProtectKernelTunables=true
|
|
|
|
|
|
|
|
# Hides processes owned by other users from pihole-FTL view
|
|
|
|
|
|
|
|
ProtectProc=invisible
|
|
|
|
|
|
|
|
# Mount the entire file system as read-only. Write access to required folders is provided via
|
|
|
|
|
|
|
|
# {Configuration,Logs,Runtime}Directory= settings
|
|
|
|
|
|
|
|
ProtectSystem=strict
|
|
|
|
|
|
|
|
RemoveIPC=true
|
|
|
|
|
|
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
|
|
|
|
|
|
|
|
RestrictNamespaces=true
|
|
|
|
|
|
|
|
RestrictRealtime=true
|
|
|
|
|
|
|
|
RestrictSUIDSGID=true
|
|
|
|
|
|
|
|
# Gives access to /run/pihole, cleared when service is stopped
|
|
|
|
|
|
|
|
RuntimeDirectory=pihole
|
|
|
|
|
|
|
|
SystemCallArchitectures=native
|
|
|
|
|
|
|
|
SystemCallFilter=@system-service
|
|
|
|
|
|
|
|
# Blacklist using the '~' character the @privileged syscall set
|
|
|
|
|
|
|
|
SystemCallFilter=~@privileged
|
|
|
|
|
|
|
|
# Hides the content of the following folders, which may contain user data, from pihole-FTL view
|
|
|
|
|
|
|
|
TemporaryFileSystem=/media /mnt /opt /run /srv /var
|
|
|
|
|
|
|
|
|
|
|
|
[Install]
|
|
|
|
[Install]
|
|
|
|
WantedBy=multi-user.target
|
|
|
|
WantedBy=multi-user.target
|
|
|
|