diff options
| author |   Richard Freeman <rich0@gentoo.org> | 2016-08-13 16:50:20 -0400 |
|---|---|---|
| committer | Richard Freeman <rich0@gentoo.org> | 2016-08-13 16:51:12 -0400 |
| commit | 4a99c7205e6f7af2d7ecb37fb0ea36cd73a6fbf7 (patch) | |
| tree | 76879c7ce745768339e0b7af30c3195e32166400 /www-servers/apache/files | |
| parent | app-misc/vifm: Bump to version 0.8.2 (diff) | |
| download | gentoo-4a99c7205e6f7af2d7ecb37fb0ea36cd73a6fbf7.tar.gz gentoo-4a99c7205e6f7af2d7ecb37fb0ea36cd73a6fbf7.tar.bz2 gentoo-4a99c7205e6f7af2d7ecb37fb0ea36cd73a6fbf7.zip | |
www-servers/apache: add systemd hardening
Bug: 586984
Package-Manager: portage-2.2.28
Diffstat (limited to 'www-servers/apache/files')
| -rw-r--r-- | www-servers/apache/files/apache2.2-hardened.service | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/www-servers/apache/files/apache2.2-hardened.service b/www-servers/apache/files/apache2.2-hardened.service new file mode 100644 index 000000000000..7a512a733e72 --- /dev/null +++ b/www-servers/apache/files/apache2.2-hardened.service @@ -0,0 +1,27 @@ +[Unit] +Description=The Apache HTTP Server +After=network.target remote-fs.target nss-lookup.target + +[Service] +EnvironmentFile=/etc/conf.d/apache2 +ExecStart=/usr/sbin/apache2 $APACHE2_OPTS -DFOREGROUND +ExecReload=/usr/sbin/apache2 $APACHE2_OPTS -k graceful +ExecStop=/usr/sbin/apache2 $APACHE2_OPTS -k graceful-stop +# We want systemd to give httpd some time to finish gracefully, but still want +# it to kill httpd after TimeoutStopSec if something went wrong during the +# graceful stop. Normally, Systemd sends SIGTERM signal right after the +# ExecStop, which would kill httpd. We are sending useless SIGCONT here to give +# httpd time to finish. +KillSignal=SIGCONT +PrivateTmp=true +#Hardening +PrivateTmp=true +CapabilityBoundingSet=CAP_CHOWN CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_KILL CAP_NET_BIND_SERVICE CAP_IPC_LOCK +SecureBits=noroot-locked +ProtectSystem=full +NoNewPrivileges=true +PrivateDevices=true +MemoryDenyWriteExecute=true + +[Install] +WantedBy=multi-user.target |