Re: [PATCH] mcstrans: harden systemd service file

On Wed, Jul 29, 2026 at 11:32 AM Johannes Segitz <[email protected]> wrote:
>
> Start to harden the systemd services file with some of the
> unproblematic options.
>
> Signed-off-by: Johannes Segitz <[email protected]>

Acked-by: Stephen Smalley <[email protected]>

> ---
>  mcstrans/src/mcstrans.service | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/mcstrans/src/mcstrans.service b/mcstrans/src/mcstrans.service
> index fdcfb0d4..114c802f 100644
> --- a/mcstrans/src/mcstrans.service
> +++ b/mcstrans/src/mcstrans.service
> @@ -7,6 +7,13 @@ Before=shutdown.target sysinit.target
>  Conflicts=shutdown.target
>
>  [Service]
> +ProtectHostname=true
> +ProtectClock=true
> +ProtectKernelTunables=true
> +ProtectKernelModules=true
> +ProtectKernelLogs=true
> +ProtectControlGroups=true
> +RestrictRealtime=true
>  ExecStart=/sbin/mcstransd -f
>  RuntimeDirectory=setrans
>  RuntimeDirectoryPreserve=true
> --
> 2.55.0
>
>