From 00aea9e0d9461a829237c8e479d3d4be75affb70 Mon Sep 17 00:00:00 2001
From: Max <msuraev@sysmocom.de>
Date: Fri, 16 Sep 2022 10:58:03 +0700
Subject: [PATCH] systemd: enable basic hardening

This ensures that systemd will not allow us to modify
/home, /root and /run/user which we shouldn't be doing anyway.
See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
for details.

It should also should silence corresponding lintian warning.

Related: OS#4107
Change-Id: Ida5f13bdb9e5bd956c440a381d94eecc18f0b2ef
---
 contrib/systemd/osmo-hlr.service | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/systemd/osmo-hlr.service b/contrib/systemd/osmo-hlr.service
index aa2f2814..7ab42799 100644
--- a/contrib/systemd/osmo-hlr.service
+++ b/contrib/systemd/osmo-hlr.service
@@ -9,6 +9,7 @@ StateDirectory=osmocom
 WorkingDirectory=%S/osmocom
 ExecStart=/usr/bin/osmo-hlr -c /etc/osmocom/osmo-hlr.cfg -l /var/lib/osmocom/hlr.db
 RestartSec=2
+ProtectHome=true
 
 [Install]
 WantedBy=multi-user.target