tree 3417b51782cdcbe22d92ead9415374f6f06bd3b6
parent 1ce8de2d93066d29e57ca2bb9cc0e0ff321f2043
author Tim Duesterhus <tim@bastelstu.be> 1519759144 +0100
committer Willy Tarreau <w@1wt.eu> 1519916235 +0100
encoding latin1

MINOR: systemd: Add SystemD's Protect*= options to the unit file

While the haproxy workers usually are running chrooted the master
process is not. This patch is a pretty safe defense in depth measure
to ensure haproxy cannot touch sensitive parts of the file system.

ProtectSystem takes non-boolean arguments in newer SystemD versions,
but setting those would leave older systems such as Ubuntu Xenial
unprotected. Distro maintainers and system administrators could
adapt the ProtectSystem value to the SystemD version they ship.