@@ -150,6 +150,26 @@ in
150150 ReadWritePaths = cfg.settings.DatabaseDirectory;
151151 RuntimeDirectory = "geoipupdate";
152152 RuntimeDirectoryMode = 0700;
153+ CapabilityBoundingSet = "";
154+ PrivateDevices = true;
155+ PrivateMounts = true;
156+ PrivateUsers = true;
157+ ProtectClock = true;
158+ ProtectControlGroups = true;
159+ ProtectHome = true;
160+ ProtectHostname = true;
161+ ProtectKernelLogs = true;
162+ ProtectKernelModules = true;
163+ ProtectKernelTunables = true;
164+ ProtectProc = "invisible";
165+ ProcSubset = "pid";
166+ SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
167+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
168+ RestrictRealtime = true;
169+ RestrictNamespaces = true;
170+ MemoryDenyWriteExecute = true;
171+ LockPersonality = true;
172+ SystemCallArchitectures = "native";
153173 };
154174 };
155175