restrict tio-trim-cache.service's write access to /srv/cache

TryItOnline · Mar 26, 2019 · b1967d1 · b1967d1
1 parent 4a51ba3
commit b1967d1
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/systemd/tio-trim-cache.service b/lib/systemd/tio-trim-cache.service
@@ -5,4 +5,7 @@ Description=Trim TIO's output cache
 Type=oneshot
 User=apache
 Group=apache
+ProtectSystem=strict
+ProtectHome=tmpfs
+ReadWritePaths=/srv/cache
 ExecStart=/srv/bin/trim-cache