From 18425a4f8317396477b5b61c5bc882395ad5e0f1 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Tue, 8 Nov 2022 22:52:26 +0000 Subject: [PATCH] Use default sandboxing for the dns-check service --- cookbooks/dns/recipes/default.rb | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/cookbooks/dns/recipes/default.rb b/cookbooks/dns/recipes/default.rb index 1cc1b1e84..856dcfcb0 100644 --- a/cookbooks/dns/recipes/default.rb +++ b/cookbooks/dns/recipes/default.rb @@ -174,12 +174,9 @@ systemd_service "dns-check" do description "Rebuild DNS zones with GeoDNS changes" exec_start "/usr/local/bin/dns-check" user "git" - private_tmp true - private_devices true - protect_system "strict" - protect_home true + sandbox :enable_network => true + proc_subset "all" read_write_paths "/var/lib/dns" - no_new_privileges true end systemd_timer "dns-check" do -- 2.39.5