From 135166270016c1fe9ec42f1555141a857e7da097 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Thu, 17 Nov 2022 18:49:12 +0000 Subject: [PATCH] Use default sandboxing for mapserv services --- cookbooks/imagery/resources/site.rb | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/cookbooks/imagery/resources/site.rb b/cookbooks/imagery/resources/site.rb index b5d50ee34..4fca7bb9a 100644 --- a/cookbooks/imagery/resources/site.rb +++ b/cookbooks/imagery/resources/site.rb @@ -113,12 +113,8 @@ action :create do group "imagery" exec_start "/usr/bin/multiwatch -f 8 --signal=TERM -- /usr/lib/cgi-bin/mapserv" standard_input "socket" - private_tmp true - private_devices true - private_network true - protect_system "full" - protect_home true - no_new_privileges true + sandbox true + restrict_address_families "AF_UNIX" # Terminate service after 30mins. Service is socket activated runtime_max_sec 1800 end -- 2.45.1