diff options
author | Christian Pointner <equinox@spreadspace.org> | 2021-06-03 22:55:21 +0200 |
---|---|---|
committer | Christian Pointner <equinox@spreadspace.org> | 2021-06-20 01:44:16 +0200 |
commit | 8bcf938a7b95536c66a34b043915615df489f243 (patch) | |
tree | c2418122e3f9def7bd6ed90a4ff6fdbe116cac00 /roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 | |
parent | prometheus: add blackbox exporter (diff) |
prometheus: fix blackbox exporter icmp probes
Diffstat (limited to 'roles/monitoring/prometheus/exporter/blackbox/templates/service.j2')
-rw-r--r-- | roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 index c9c5712c..a8a91d0b 100644 --- a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 +++ b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 @@ -8,8 +8,13 @@ ExecStart=/usr/bin/prometheus-blackbox-exporter --web.listen-address="127.0.0.1: ExecReload=/bin/kill -HUP $MAINPID # systemd hardening-options +{% if prometheus_exporter_blackbox_modules | combine(prometheus_exporter_blackbox_modules_extra) | dict2items | selectattr('value.prober', 'eq', 'icmp') | length > 0 %} AmbientCapabilities=CAP_NET_RAW CapabilityBoundingSet=CAP_NET_RAW +{% else %} +AmbientCapabilities= +CapabilityBoundingSet= +{% endif %} DeviceAllow=/dev/null rw DevicePolicy=strict LockPersonality=true @@ -17,7 +22,6 @@ MemoryDenyWriteExecute=true NoNewPrivileges=true PrivateDevices=true PrivateTmp=true -PrivateUsers=true ProtectControlGroups=true ProtectHome=true ProtectKernelModules=true |