senselab/ansible-role-php
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add more hardening options

Browse source
This commit is contained in:
phil 2023-02-25 20:32:51 +01:00
parent 367b5eede0
commit 4f0d2f55e1
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
templates/systemd/php-fpm@.service
View file

@ -26,18 +26,29 @@ RestartSec=30s
# Hardening # Hardening
# https://github.com/php/php-src/blob/master/sapi/fpm/php-fpm.service.in # https://github.com/php/php-src/blob/master/sapi/fpm/php-fpm.service.in
LockPersonality=true
NoNewPrivileges=true
PrivateDevices=true PrivateDevices=true
PrivateTmp=true PrivateTmp=true
ProtectClock=true ProtectClock=true
ProtectControlGroups=true ProtectControlGroups=true
ProtectKernelModules=true ProtectKernelModules=true
ProtectKernelTunables=true ProtectKernelTunables=true
ProtectSystem=full ProtectSystem=strict
RestrictRealtime=true RestrictRealtime=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
RestrictNamespaces=true RestrictNamespaces=true
SystemCallFilter=@system-service SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
ReadWritePaths=-/var/log/
ReadWritePaths=-{{ php_fpm_log_dir }}
ReadWritePaths=-/var/run/
ReadWritePaths=-/run/
InaccessiblePaths=-/root/
RuntimeDirectory=php
RuntimeDirectoryPreserve=yes
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target