From 40cc0efcf8587c25f027e8512267c0d842fe7926 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Sat, 5 Sep 2026 16:28:55 +0200
Subject: [PATCH] fix(fail2ban): use ProtectSystem=full so ufw can create its
 lock file

strict makes /run read-only, which blocks ufw's /run/ufw.lock and
cannot be whitelisted via ReadWritePaths (the file does not exist).
full still protects /usr and /etc while leaving /run and /var writable,
so only /etc/ufw needs an explicit write path.
---
 roles/fail2ban/README.md                           | 2 +-
 roles/fail2ban/templates/hardened.fail2ban.conf.j2 | 6 +-----
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/roles/fail2ban/README.md b/roles/fail2ban/README.md
index 2b0066e..911da51 100644
--- a/roles/fail2ban/README.md
+++ b/roles/fail2ban/README.md
@@ -10,7 +10,7 @@ Bans brute-force sources via UFW. Reads logs from the systemd journal (`backend
 ## Notes
 
 - Logs to the journal (`logtarget = STDOUT` in `fail2ban.local`) — see `journalctl -u fail2ban`.
-- The systemd unit is hardened (`ProtectSystem=strict`); the drop-in lives at `/etc/systemd/system/fail2ban.service.d/override.conf` and is fully managed by the role.
+- The systemd unit is hardened (`ProtectSystem=full`); the drop-in lives at `/etc/systemd/system/fail2ban.service.d/override.conf` and is fully managed by the role.
 - Firewall/banaction is UFW on every host; jails ban via `ufw prepend reject`.
 
 ## Variables
diff --git a/roles/fail2ban/templates/hardened.fail2ban.conf.j2 b/roles/fail2ban/templates/hardened.fail2ban.conf.j2
index 26162e9..9860429 100644
--- a/roles/fail2ban/templates/hardened.fail2ban.conf.j2
+++ b/roles/fail2ban/templates/hardened.fail2ban.conf.j2
@@ -2,12 +2,8 @@
 PrivateDevices=yes
 PrivateTmp=yes
 ProtectHome=read-only
-ProtectSystem=strict
+ProtectSystem=full
 RuntimeDirectory=fail2ban
 RuntimeDirectoryMode=0750
-ReadWritePaths=-/var/lib/fail2ban
-ReadWritePaths=-/var/spool/postfix/maildrop
-ReadWritePaths=-/run/xtables.lock
 ReadWritePaths=-/etc/ufw
-ReadWritePaths=-/var/lib/ufw
 CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW