Clément Désiles
40cc0efcf8
strict makes /run read-only, which blocks ufw's /run/ufw.lock and cannot be whitelisted via ReadWritePaths (the file does not exist). full still protects /usr and /etc while leaving /run and /var writable, so only /etc/ufw needs an explicit write path.
10 lines
245 B
Django/Jinja
10 lines
245 B
Django/Jinja
[Service]
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
ProtectHome=read-only
|
|
ProtectSystem=full
|
|
RuntimeDirectory=fail2ban
|
|
RuntimeDirectoryMode=0750
|
|
ReadWritePaths=-/etc/ufw
|
|
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
|