[systemd] Sandbox the mce service. JB#37897 JB#44449

sailfishos · Jun 11, 2019 · ae2c435 · ae2c435
1 parent f3d5ba9
commit ae2c435
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/systemd/mce.service b/systemd/mce.service
@@ -11,6 +11,18 @@ Conflicts=shutdown.target
 Type=notify
 ExecStart=/usr/sbin/mce --systemd
 Restart=always
+# Sandboxing
+CapabilityBoundingSet=CAP_BLOCK_SUSPEND CAP_DAC_OVERRIDE CAP_FOWNER
+# System update uses /tmp/os-update-running which should be relocated
+PrivateTmp=no
+ProtectHome=yes
+ProtectSystem=full
+DevicePolicy=closed
+DeviceAllow=char-input r
+DeviceAllow=/dev/fb0 rw
+DeviceAllow=/dev/i2c-0 rw
+DeviceAllow=/dev/i2c-1 rw
+DeviceAllow=/dev/memnotify rw
 
 [Install]
 WantedBy=multi-user.target