Skip to content

Instantly share code, notes, and snippets.

@sevu

sevu/wesnothd.service

Last active August 20, 2017 16:00
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save sevu/b70f5406ad8ad38f417f5155017b68b0 to your computer and use it in GitHub Desktop.
Save sevu/b70f5406ad8ad38f417f5155017b68b0 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
wesnothd.service
[Unit]
Description=Wesnoth@BINARY_SUFFIX@ Multiplayer Server Daemon
Documentation=man:wesnothd(6)
After=network.target
[Service]
ExecStart=@CMAKE_INSTALL_PREFIX@/@BINDIR@/wesnothd@BINARY_SUFFIX@
SyslogIdentifier=Wesnothd@BINARY_SUFFIX@
User=nobody
Group=nogroup
# Additional security-related features
ProtectHome=yes
ProtectSystem=full
PrivateTmp=yes
PrivateDevices=yes
NoNewPrivileges=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
# needs v231
RestrictRealtime=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
# needs v232
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
# needs v233
RestrictNamespaces=yes
[Install]
WantedBy=multi-user.target
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment