From: Tom Hughes <tom@compton.nu>
Date: Wed, 16 Nov 2022 20:26:32 +0000 (+0000)
Subject: Use default sandboxing for the oxidized service
X-Git-Url: https://git.openstreetmap.org/chef.git/commitdiff_plain/d4255068eb429695ebb8734f1ccc65cf346c024a

Use default sandboxing for the oxidized service
---

diff --git a/cookbooks/oxidized/recipes/default.rb b/cookbooks/oxidized/recipes/default.rb
index 4d1da0343..7e4803c70 100644
--- a/cookbooks/oxidized/recipes/default.rb
+++ b/cookbooks/oxidized/recipes/default.rb
@@ -147,11 +147,8 @@ systemd_service "oxidized" do
   environment "OXIDIZED_HOME" => "/etc/oxidized",
               "OXIDIZED_LOGS" => "/var/log/oxidized"
   nice 10
-  private_tmp true
-  private_devices true
-  protect_system "full"
-  protect_home true
-  no_new_privileges true
+  sandbox :enable_network => true
+  read_write_paths ["/run/oxidized", "/var/lib/oxidized", "/var/log/oxidized"]
   restart "on-failure"
   notifies :restart, "service[oxidized]"
 end