32 lines
1,016 B
Desktop File
32 lines
1,016 B
Desktop File
[Unit]
|
|
Description=BastionGuard™ Secure Connection Daemon
|
|
Documentation=https://git.bastionguard.eu/specialworld83/bastionguard-secure-connection
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
ExecStart=/usr/bin/bsc-daemon \
|
|
-rules-path /etc/bastionguard-secure-connectiond/rules \
|
|
-ui-socket unix:///tmp/bsd-daemon.sock
|
|
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
TimeoutStopSec=5s
|
|
|
|
# Capabilities necessarie:
|
|
# CAP_NET_ADMIN -> nft (add table/chain/rule), NFQUEUE (nfq_create_queue)
|
|
# CAP_NET_RAW -> lettura header pacchetti grezzi
|
|
# CAP_SYS_PTRACE -> lettura /proc/<pid>/{exe,cwd,environ} di altri processi
|
|
# CAP_DAC_READ_SEARCH -> bypass permessi su /proc
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_BPF CAP_PERFMON
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_BPF CAP_PERFMON
|
|
|
|
# Hardening di base
|
|
NoNewPrivileges=true
|
|
ProtectSystem=full
|
|
ProtectHome=true
|
|
PrivateTmp=false
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|