michael.heier/jellyfin
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Merge pull request #6985 from joshuaboniface/unharden-for-lxc

Browse Source
This commit is contained in:
Joshua M. Boniface 2022-03-19 12:31:33 -04:00 committed by GitHub
commit 464ebf93dd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 57 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
debian/conf/jellyfin vendored
View File

@ -44,6 +44,8 @@ JELLYFIN_ADDITIONAL_OPTS=""
# #
# SysV init/Upstart options # SysV init/Upstart options
# #
# Note: These options are ignored by systemd; use /etc/systemd/system/jellyfin.d overrides instead.
#
# Application username # Application username
JELLYFIN_USER="jellyfin" JELLYFIN_USER="jellyfin"

16
debian/jellyfin.service vendored
View File

@ -6,23 +6,26 @@ After = network-online.target
Type = simple Type = simple
EnvironmentFile = /etc/default/jellyfin EnvironmentFile = /etc/default/jellyfin
User = jellyfin User = jellyfin
Group = jellyfin
WorkingDirectory = /var/lib/jellyfin
ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS} ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS}
Restart = on-failure Restart = on-failure
TimeoutSec = 15 TimeoutSec = 15
SuccessExitStatus=0 143
NoNewPrivileges=true NoNewPrivileges=true
SystemCallArchitectures=native SystemCallArchitectures=native
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=true RestrictNamespaces=false
RestrictRealtime=true RestrictRealtime=true
RestrictSUIDSGID=true RestrictSUIDSGID=true
ProtectControlGroups=true ProtectControlGroups=false
ProtectHostname=true ProtectHostname=true
ProtectKernelLogs=true ProtectKernelLogs=false
ProtectKernelModules=true ProtectKernelModules=false
ProtectKernelTunables=true ProtectKernelTunables=false
LockPersonality=true LockPersonality=true
PrivateTmp=true PrivateTmp=false
PrivateDevices=false PrivateDevices=false
PrivateUsers=true PrivateUsers=true
RemoveIPC=true RemoveIPC=true
@ -43,6 +46,5 @@ SystemCallFilter=~@setuid
SystemCallFilter=~@swap SystemCallFilter=~@swap
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
[Install] [Install]
WantedBy = multi-user.target WantedBy = multi-user.target

46
fedora/jellyfin.service
View File

@ -1,15 +1,51 @@
[Unit] [Unit]
Description = Jellyfin Media Server
After = network-online.target After = network-online.target
Description=Jellyfin is a free software media system that puts you in control of managing and streaming your media.
[Service] [Service]
Type = simple
EnvironmentFile = /etc/sysconfig/jellyfin EnvironmentFile = /etc/sysconfig/jellyfin
WorkingDirectory=/var/lib/jellyfin
ExecStart=/usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT}
TimeoutSec=15
Restart=on-failure
User = jellyfin User = jellyfin
Group = jellyfin Group = jellyfin
WorkingDirectory = /var/lib/jellyfin
ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS}
Restart = on-failure
TimeoutSec = 15
SuccessExitStatus=0 143
NoNewPrivileges=true
SystemCallArchitectures=native
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=false
RestrictRealtime=true
RestrictSUIDSGID=true
ProtectClock=true
ProtectControlGroups=false
ProtectHostname=true
ProtectKernelLogs=false
ProtectKernelModules=false
ProtectKernelTunables=false
LockPersonality=true
PrivateTmp=false
PrivateDevices=false
PrivateUsers=true
RemoveIPC=true
SystemCallFilter=~@clock
SystemCallFilter=~@aio
SystemCallFilter=~@chown
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@debug
SystemCallFilter=~@keyring
SystemCallFilter=~@memlock
SystemCallFilter=~@module
SystemCallFilter=~@mount
SystemCallFilter=~@obsolete
SystemCallFilter=~@privileged
SystemCallFilter=~@raw-io
SystemCallFilter=~@reboot
SystemCallFilter=~@setuid
SystemCallFilter=~@swap
SystemCallErrorNumber=EPERM
[Install] [Install]
WantedBy = multi-user.target WantedBy = multi-user.target