65 lines
2.1 KiB
Desktop File
65 lines
2.1 KiB
Desktop File
[Unit]
|
|
Description=MultiSimAdmin relay agent
|
|
Documentation=https://gitea.chickliu.fun/Hermes/simadmin-relay
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/opt/msa-agent/msa-agent --config /etc/msa-agent/config.json
|
|
Restart=always
|
|
# Backing off on our own is not enough: a relay that is down for an hour should not be hammered by
|
|
# every node in the fleet the moment it comes back.
|
|
RestartSec=5
|
|
TimeoutStopSec=20
|
|
KillSignal=SIGTERM
|
|
|
|
User=msa-agent
|
|
Group=msa-agent
|
|
|
|
# The agent needs almost nothing from the host. Everything below is a capability the process never
|
|
# uses, removed so that a compromise of the agent is not automatically a compromise of the box.
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
PrivateUsers=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RemoveIPC=yes
|
|
UMask=0077
|
|
|
|
# Configuration and the audit log are the only writable paths. ReadWritePaths is what keeps
|
|
# ProtectSystem=strict from making the audit log unwritable.
|
|
ReadWritePaths=/var/log/msa-agent
|
|
ConfigurationDirectory=msa-agent
|
|
LogsDirectory=msa-agent
|
|
|
|
# AF_INET and AF_INET6 only: the agent dials out to the relay and to 127.0.0.1, so it has no reason
|
|
# to reach a Unix socket, a netlink family or a packet socket.
|
|
#
|
|
# No IPAddressDeny / IPAddressAllow pair here, deliberately. It reads like the obvious way to pin the
|
|
# agent to loopback, and it is wrong: those directives filter both directions, so IPAddressDeny=any
|
|
# would also cut the outbound connection to the relay the agent exists to maintain. The loopback
|
|
# invariant is enforced in code by internal/egress, which is testable, rather than by a directive
|
|
# that silently breaks the only path out.
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
# No capability at all, so the process cannot even ask to bind a privileged port.
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|