From 0f64cd1a2e809d447c25d9b8ca3b7ec7eac2cf40 Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Thu, 3 May 2018 12:59:41 +0200
Subject: Lock down systemd service file

Use systemd's service file to lockdown the geoclue daemon to stop
eventual security problems.

https://bugs.freedesktop.org/show_bug.cgi?id=106190
---
 data/geoclue.service.in | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

(limited to 'data')

diff --git a/data/geoclue.service.in b/data/geoclue.service.in
index dc77b48..6449d30 100644
--- a/data/geoclue.service.in
+++ b/data/geoclue.service.in
@@ -6,3 +6,25 @@ Type=dbus
 BusName=org.freedesktop.GeoClue2
 User=@dbus_srv_user@
 ExecStart=@libexecdir@/geoclue
+
+# Filesystem lockdown
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectControlGroups=true
+ProtectHome=true
+PrivateTmp=true
+
+# Network
+PrivateNetwork=false
+
+# Execute Mappings
+MemoryDenyWriteExecute=true
+
+# Modules
+ProtectKernelModules=true
+
+# Real-time
+RestrictRealtime=true
+
+# Privilege escalation
+NoNewPrivileges=true
-- 
cgit v1.2.1