From 77c8997c20e5b93a56299850ec1ce4216f8f8b3f Mon Sep 17 00:00:00 2001
From: Benjamin Barenblat <bbaren@google.com>
Date: Mon, 19 Apr 2021 14:19:51 -0400
Subject: localsubnetsetd, a daemon to track the local subnet for nftables

---
 localsubnetsetd.service | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 localsubnetsetd.service

(limited to 'localsubnetsetd.service')

diff --git a/localsubnetsetd.service b/localsubnetsetd.service
new file mode 100644
index 0000000..4279569
--- /dev/null
+++ b/localsubnetsetd.service
@@ -0,0 +1,39 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy of
+# the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations under
+# the License.
+
+[Unit]
+Description=local subnet set maintenance daemon
+Requires=nftables.service
+After=nftables.service
+
+[Service]
+ExecStart=localsubnetsetd
+Restart=always
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_NETLINK
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+SystemCallFilter=@system-service
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=sysinit.target
-- 
cgit v1.2.3