0f3d48a378
snowflake-proxy doesn't write any files => run in read-only rootfs environment the process needs to read SSL certs but no other files => only exposed path is /etc/ssl/certificates (read-only) running as unpriviledged user with no additional capabilities => set no-new-privs bit By default procd-ujail also isolates the process by executing it in a separate new IPC and PID namespace. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
23 lines
475 B
Bash
23 lines
475 B
Bash
#!/bin/sh /etc/rc.common
|
|
|
|
START=99
|
|
|
|
USE_PROCD=1
|
|
NAME=snowflake-proxy
|
|
PROG=/usr/bin/$NAME
|
|
|
|
start_service() {
|
|
procd_open_instance
|
|
procd_set_param command "$PROG" -verbose
|
|
procd_set_param stdout 1
|
|
procd_set_param stderr 1
|
|
procd_set_param user snowflake
|
|
procd_set_param group snowflake
|
|
procd_set_param respawn
|
|
[ -x /sbin/ujail ] && {
|
|
procd_add_jail snowflake-proxy ronly
|
|
procd_add_jail_mount /etc/ssl/certs
|
|
procd_set_param no_new_privs 1
|
|
}
|
|
procd_close_instance
|
|
}
|