Skip to content

Commit 6fe6235

Browse files
committed
fix: Remove ProtectSystem=strict from service file
ProtectSystem=strict with ReadWritePaths fails when paths do not exist (e.g., /usr/local/etc/wireguard on Linux). Removing the security hardening as wgrest requires root for wg-quick anyway.
1 parent 0d797c3 commit 6fe6235

File tree

1 file changed

+0
-4
lines changed

1 file changed

+0
-4
lines changed

packaging/wgrest.service

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,6 @@ Group=root
1010
ExecStart=/usr/local/bin/wgrest --conf /etc/wgrest/wgrest.conf
1111
Restart=always
1212
RestartSec=1
13-
# Security hardening (where possible while running as root)
14-
NoNewPrivileges=no
15-
ProtectSystem=strict
16-
ReadWritePaths=/etc/wireguard /usr/local/etc/wireguard /var/lib/wgrest
1713

1814
[Install]
1915
WantedBy=multi-user.target

0 commit comments

Comments
 (0)