From: Tom Hughes <tom@compton.nu>
Date: Fri, 25 Nov 2022 17:48:50 +0000 (+0000)
Subject: Improve sandboxing of matomo archiver
X-Git-Url: https://git.openstreetmap.org./chef.git/commitdiff_plain/d225dda62ccb2036e610125f42cbe91b21809c80

Improve sandboxing of matomo archiver
---

diff --git a/cookbooks/matomo/recipes/default.rb b/cookbooks/matomo/recipes/default.rb
index 2bc613e13..9cea5099d 100644
--- a/cookbooks/matomo/recipes/default.rb
+++ b/cookbooks/matomo/recipes/default.rb
@@ -203,7 +203,8 @@ systemd_service "matomo-archive" do
   description "Matomo report archiving"
   exec_start "/usr/bin/php /srv/matomo.openstreetmap.org/console core:archive --url=https://matomo.openstreetmap.org/"
   user "www-data"
-  sandbox :enable_network => true
+  sandbox true
+  proc_subset "all"
   memory_deny_write_execute false
   restrict_address_families "AF_UNIX"
   read_write_paths "/opt/matomo-#{version}/matomo/tmp"