From 924453c22599cc246746a0233b2f52a27ade0819 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 9 Feb 2017 11:17:45 +0100
Subject: [PATCH] units: lock down coredump service a bit

Dissecting a coredump is possibly risky and might take a while, hence
lock down the unit as much as we can.
---
 units/systemd-coredump@.service.in | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in
index f12b28d6a6..18f2d2d605 100644
--- a/units/systemd-coredump@.service.in
+++ b/units/systemd-coredump@.service.in
@@ -19,9 +19,19 @@ Before=shutdown.target
 ExecStart=-@rootlibexecdir@/systemd-coredump
 Nice=9
 OOMScoreAdjust=500
+RuntimeMaxSec=5min
+PrivateTmp=yes
+PrivateDevices=yes
 PrivateNetwork=yes
 ProtectSystem=strict
-RuntimeMaxSec=5min
+ProtectHome=yes
+ProtectControlGroups=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictNamespaces=yes
+RestrictAddressFamilies=AF_UNIX
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
 SystemCallArchitectures=native
 ReadWritePaths=/var/lib/systemd/coredump
-ProtectKernelModules=yes