Commit f58cdb3b authored by Nick Mathewson's avatar Nick Mathewson 🏃
Browse files

Merge remote-tracking branch 'intrigeri/bug12751-systemd-filesystem-sandbox'

parents ed8f020e 9f0161f7
o Distribution:
- systemd unit file: only allow tor to write to /var/lib/tor
and /var/log/tor. The rest of the filesystem is accessible
for reading only.
Patch by intrigeri; resolves ticket 12751.
......@@ -19,6 +19,9 @@ PrivateTmp = yes
DeviceAllow = /dev/null rw
DeviceAllow = /dev/urandom r
InaccessibleDirectories = /home
ReadOnlyDirectories = /
ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor
ReadWriteDirectories = @LOCALSTATEDIR@/log/tor
[Install]
WantedBy = multi-user.target
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment