Modernise some older systemd services

[chef.git] / cookbooks / squid / recipes / default.rb

diff --git a/cookbooks/squid/recipes/default.rb b/cookbooks/squid/recipes/default.rb
index def3d9187f2aa642c2c90a654ad588a83cc8b3f1..731cbdd83c0f408a7e8f973528ad7a23ad6031b4 100644 (file)
--- a/cookbooks/squid/recipes/default.rb
+++ b/cookbooks/squid/recipes/default.rb
@@ -50,6 +50,11 @@ systemd_service "squid" do
   exec_start "/usr/sbin/squid -N $SQUID_ARGS"
   exec_reload "/usr/sbin/squid -k reconfigure"
   exec_stop "/usr/sbin/squid -k shutdown"
   exec_start "/usr/sbin/squid -N $SQUID_ARGS"
   exec_reload "/usr/sbin/squid -k reconfigure"
   exec_stop "/usr/sbin/squid -k shutdown"

+  private_tmp true
+  private_devices true
+  protect_system "full"
+  protect_home true
+  no_new_privileges true

   restart "on-failure"
   timeout_sec 0
 end
   restart "on-failure"
   timeout_sec 0
 end