mirror of
https://gitlab.com/mobian1/eg25-manager.git
synced 2025-08-30 07:42:23 +02:00
67195a8e58
With eg25-manager directly interfacing with the untrusted modem and potentially (MR !15) including libcurl for HTTP, sandboxing the daemon significantly reduces the any post-exploit attack surface.
29 lines
546 B
Desktop File
29 lines
546 B
Desktop File
[Unit]
|
|
Description=Quectel EG25 modem
|
|
Before=ModemManager.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/eg25manager
|
|
Restart=on-failure
|
|
ProtectControlGroups=true
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectSystem=strict
|
|
RestrictSUIDSGID=true
|
|
PrivateTmp=true
|
|
ProtectedKernelModules=true
|
|
MemoryDenyWriteExecute=true
|
|
PrivateMounts=true
|
|
NoNewPrivileges=true
|
|
CapabilityBoundingSet=
|
|
ProtectProc=true
|
|
ProtectDevices=true
|
|
DeviceAllow=/dev/ttyS2
|
|
LockPersonality=true
|
|
ProtectClock=true
|
|
ProtectKernelLog=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|