From 24da96a1bdd6fef2e23d7c23581d572209f8cca7 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 6 Aug 2020 14:50:38 +0200
Subject: units: turn on ProtectProc= wherever suitable

---
 units/systemd-journal-gatewayd.service.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'units/systemd-journal-gatewayd.service.in')

diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in
index 8071395e68..2436f2a2cf 100644
--- a/units/systemd-journal-gatewayd.service.in
+++ b/units/systemd-journal-gatewayd.service.in
@@ -19,12 +19,13 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 PrivateDevices=yes
 PrivateNetwork=yes
+ProtectProc=invisible
 ProtectControlGroups=yes
 ProtectHome=yes
 ProtectHostname=yes
+ProtectKernelLogs=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
-ProtectKernelLogs=yes
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictNamespaces=yes
 RestrictRealtime=yes
-- 
cgit v1.2.1