systemd: harden eterban services

gateway/etc/systemd/system/eterban-api.service

@@ -8,6 +8,11 @@ ExecStart=/usr/bin/python3 /usr/share/eterban/eterban_api.py
 Restart=always
 RestartSec=5
 RestartPreventExitStatus=78
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=full
+UMask=0077
 
 [Install]
 WantedBy=multi-user.target

gateway/etc/systemd/system/eterban-internal.service

@@ -8,6 +8,11 @@ ExecStart=/usr/bin/python3 /usr/share/eterban/eterban_internal.py
 Restart=on-failure
 RestartSec=5
 RestartPreventExitStatus=78
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=full
+UMask=0077
 
 [Install]
 WantedBy=multi-user.target

gateway/etc/systemd/system/eterban.service

@@ -6,6 +6,11 @@ After=syslog.target network.target
 Restart=always
 RestartPreventExitStatus=78
 ExecStart=/usr/bin/python3 /usr/share/eterban/eterban_switcher.py
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=full
+UMask=0077
 
 [Install]
 WantedBy=multi-user.target

tests/static-checks.sh

@@ -64,3 +64,12 @@ if rg -q 'exec /usr/share/eterban/.*\.py' gateway/usr/bin/eterban.sh || ! rg -qx
 fi
 
 sh tests/cli-interface.sh
+
+for unit in gateway/etc/systemd/system/eterban.service gateway/etc/systemd/system/eterban-api.service gateway/etc/systemd/system/eterban-internal.service; do
+    for directive in 'NoNewPrivileges=true' 'PrivateTmp=true' 'ProtectHome=true' 'ProtectSystem=full' 'UMask=0077'; do
+        rg -qx "$directive" "$unit" || {
+            echo "$unit is missing $directive" >&2
+            exit 1
+        }
+    done
+done