Merge remote-tracking branch 'intrigeri/bug12751-systemd-filesystem-sandbox'

2024-12-06 19:41:15 +01:00 · 2014-09-03 13:28:46 -04:00
parent ed8f020e20 9f0161f73d
commit f58cdb3be7
2 changed files with 8 additions and 0 deletions
@@ -0,0 +1,5 @@
+  o Distribution:
+    - systemd unit file: only allow tor to write to /var/lib/tor
+      and /var/log/tor. The rest of the filesystem is accessible
+      for reading only.
+      Patch by intrigeri; resolves ticket 12751.
@@ -19,6 +19,9 @@ PrivateTmp = yes
 DeviceAllow = /dev/null rw
 DeviceAllow = /dev/urandom r
 InaccessibleDirectories = /home
+ReadOnlyDirectories = /
+ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor
+ReadWriteDirectories = @LOCALSTATEDIR@/log/tor

 [Install]
 WantedBy = multi-user.target