Merge pull request #579 from DarthRL/allow-more-security-options

Allow more security-related options in Service units

Author: kenyon

REFERENCE.md

@@ -5882,6 +5882,11 @@ Struct[{
     Optional['ExecPaths']                 => Variant[Stdlib::Unixpath,Pattern[/^-?\+?\/.+/], Array[Variant[Stdlib::Unixpath,Pattern[/^-?\+?\/.+/]],1]],
     Optional['NoExecPaths']               => Variant[Stdlib::Unixpath,Pattern[/^-?\+?\/.+/], Array[Variant[Stdlib::Unixpath,Pattern[/^-?\+?\/.+/]],1]],
     Optional['PrivateDevices']            => Boolean,
+    Optional['PrivateNetwork']            => Boolean,
+    Optional['PrivateIPC']                => Boolean,
+    Optional['PrivatePIDs']               => Boolean,
+    Optional['PrivateBPF']                => Boolean,
+    Optional['PrivateMounts']             => Boolean,
     Optional['RemoveIPC']                 => Boolean,
     Optional['ProtectKernelModules']      => Boolean,
     Optional['ProtectKernelTunables']     => Boolean,
@@ -5909,6 +5914,7 @@ Struct[{
     Optional['RootImageOptions']          => String,
     Optional['RootEphemeral']             => Boolean,
     Optional['RootHash']                  => String,
+    Optional['RootDirectory']             => Stdlib::Unixpath,
     Optional['LoadCredential']            => Variant[String[0],Array[String[0],1]],
     Optional['LoadCredentialEncrypted']   => Variant[String[0],Array[String[0],1]],
     Optional['SetCredential']             => Variant[String[0],Array[String[0],1]],

types/unit/service.pp

@@ -118,6 +118,11 @@
     Optional['ExecPaths']                 => Variant[Stdlib::Unixpath,Pattern[/^-?\+?\/.+/], Array[Variant[Stdlib::Unixpath,Pattern[/^-?\+?\/.+/]],1]],
     Optional['NoExecPaths']               => Variant[Stdlib::Unixpath,Pattern[/^-?\+?\/.+/], Array[Variant[Stdlib::Unixpath,Pattern[/^-?\+?\/.+/]],1]],
     Optional['PrivateDevices']            => Boolean,
+    Optional['PrivateNetwork']            => Boolean,
+    Optional['PrivateIPC']                => Boolean,
+    Optional['PrivatePIDs']               => Boolean,
+    Optional['PrivateBPF']                => Boolean,
+    Optional['PrivateMounts']             => Boolean,
     Optional['RemoveIPC']                 => Boolean,
     Optional['ProtectKernelModules']      => Boolean,
     Optional['ProtectKernelTunables']     => Boolean,
@@ -145,6 +150,7 @@
     Optional['RootImageOptions']          => String,
     Optional['RootEphemeral']             => Boolean,
     Optional['RootHash']                  => String,
+    Optional['RootDirectory']             => Stdlib::Unixpath,
     Optional['LoadCredential']            => Variant[String[0],Array[String[0],1]],
     Optional['LoadCredentialEncrypted']   => Variant[String[0],Array[String[0],1]],
     Optional['SetCredential']             => Variant[String[0],Array[String[0],1]],