diff --git a/templates/systemd/php-fpm@.service b/templates/systemd/php-fpm@.service index 5bb1411..08658b5 100644 --- a/templates/systemd/php-fpm@.service +++ b/templates/systemd/php-fpm@.service @@ -26,15 +26,13 @@ RestartSec=30s # Hardening # https://github.com/php/php-src/blob/master/sapi/fpm/php-fpm.service.in -LockPersonality=true -NoNewPrivileges=true PrivateDevices=true PrivateTmp=true ProtectClock=true ProtectControlGroups=true ProtectKernelModules=true ProtectKernelTunables=true -ProtectSystem=strict +ProtectSystem=full RestrictRealtime=true RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX RestrictNamespaces=true @@ -42,12 +40,6 @@ SystemCallArchitectures=native SystemCallErrorNumber=EPERM SystemCallFilter=@system-service -ReadWritePaths=-/var/log/ -ReadWritePaths=-{{ php_fpm_log_dir }}/ -ReadWritePaths=-/var/run/ -ReadWritePaths=-/run/ -InaccessiblePaths=-/root/ - # Resources CPUQuota={{ php_fpm_cpu_quota }} MemoryHigh={{ php_fpm_memory_high }}