diff --git a/src/service/monit.service b/src/service/monit.service index 3cccc76..cfe8549 100644 --- a/src/service/monit.service +++ b/src/service/monit.service @@ -12,25 +12,5 @@ ExecReload=/usr/bin/monit reload Restart=on-abnormal StandardOutput=null -# hardening options -# details: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -CapabilityBoundingSet=~CAP_SYS_ADMIN -LockPersonality=true -MemoryDenyWriteExecute=true -NoNewPrivileges=true -PrivateTmp=true -ProtectClock=true -ProtectControlGroups=true -ProtectHome=yes -ProtectHostname=true -ProtectKernelLogs=true -ProtectKernelModules=true -ProtectKernelTunables=true -ProtectSystem=strict -ReadWritePaths=/run/ /var/lib/monit/ /var/log/ /etc/tedge/ /opt/tedge-monit/ -RestrictRealtime=true -RestrictSUIDSGID=true -SystemCallArchitectures=native - [Install] WantedBy=multi-user.target