@profullstack/threatcrush 0.2.0 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/daemon.js +1933 -234
- package/dist/daemon.js.map +1 -1
- package/dist/index.js +2560 -222
- package/dist/index.js.map +1 -1
- package/dist/systemd/threatcrushd.service +10 -3
- package/package.json +1 -1
|
@@ -24,9 +24,16 @@ PrivateTmp=true
|
|
|
24
24
|
StandardOutput=journal
|
|
25
25
|
StandardError=journal
|
|
26
26
|
|
|
27
|
-
#
|
|
28
|
-
|
|
29
|
-
|
|
27
|
+
# Capabilities the daemon actually needs:
|
|
28
|
+
# CAP_NET_RAW / CAP_NET_ADMIN — raw packet capture for network-monitor module
|
|
29
|
+
# CAP_DAC_READ_SEARCH — read mode-640 logs (auth.log, syslog, nginx) the
|
|
30
|
+
# daemon doesn't own without falling back to mode 666
|
|
31
|
+
# CAP_DAC_OVERRIDE — same idea for the rare write that needs it
|
|
32
|
+
# CAP_CHOWN — chgrp the IPC socket to `adm` so non-root
|
|
33
|
+
# users in that group can talk to the daemon
|
|
34
|
+
AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN
|
|
35
|
+
CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN
|
|
36
|
+
|
|
30
37
|
|
|
31
38
|
[Install]
|
|
32
39
|
WantedBy=multi-user.target
|
package/package.json
CHANGED