diff options
Diffstat (limited to 'roles/monitoring/prometheus/exporter/blackbox/templates/service.j2')
| -rw-r--r-- | roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 index c9c5712c..a8a91d0b 100644 --- a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 +++ b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 @@ -8,8 +8,13 @@ ExecStart=/usr/bin/prometheus-blackbox-exporter --web.listen-address="127.0.0.1: ExecReload=/bin/kill -HUP $MAINPID # systemd hardening-options +{% if prometheus_exporter_blackbox_modules | combine(prometheus_exporter_blackbox_modules_extra) | dict2items | selectattr('value.prober', 'eq', 'icmp') | length > 0 %} AmbientCapabilities=CAP_NET_RAW CapabilityBoundingSet=CAP_NET_RAW +{% else %} +AmbientCapabilities= +CapabilityBoundingSet= +{% endif %} DeviceAllow=/dev/null rw DevicePolicy=strict LockPersonality=true @@ -17,7 +22,6 @@ MemoryDenyWriteExecute=true NoNewPrivileges=true PrivateDevices=true PrivateTmp=true -PrivateUsers=true ProtectControlGroups=true ProtectHome=true ProtectKernelModules=true |