sashatrask
51 lines
1.3 KiB
Desktop File
51 lines
1.3 KiB
Desktop File
[Unit]
|
|
Description=Truf privileged host operations agent
|
|
Requires=truf-host-agent.socket docker.service
|
|
After=truf-host-agent.socket docker.service
|
|
|
|
[Service]
|
|
Type=exec
|
|
User=root
|
|
Group=root
|
|
UMask=0077
|
|
WorkingDirectory=/
|
|
ExecStartPre=/usr/bin/python3 -I -B /usr/lib/truf-host-agent/truf_host_agent_install.py validate
|
|
ExecStart=/usr/bin/python3 -I -B /usr/lib/truf-host-agent/truf_host_agent.py
|
|
RuntimeDirectory=truf-host-agent
|
|
RuntimeDirectoryMode=0700
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
|
|
AmbientCapabilities=
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
PrivateNetwork=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectProc=invisible
|
|
ProcSubset=pid
|
|
RestrictAddressFamilies=AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
ReadWritePaths=/etc/truf/runtime
|
|
ReadWritePaths=/var/lib/truf/host-agent
|
|
ReadWritePaths=/run/truf-host-agent
|
|
ReadWritePaths=/run/docker.sock
|
|
ReadOnlyPaths=/usr/lib/truf-host-agent
|
|
ReadOnlyPaths=/opt/truf
|
|
ReadOnlyPaths=/var/lib/truf/runtime-document-candidates
|
|
ReadOnlyPaths=/run/truf-postgres
|
|
Restart=no
|
|
TimeoutStopSec=45min
|
|
StandardOutput=null
|
|
StandardError=journal
|