From 24000d67eadba30bc94605e879ff663a8d79c288 Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Tue, 26 May 2026 09:50:22 +0200 Subject: [PATCH] fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hub + portal stayed `inactive (dead)` on real-hardware boot. The journal error was `Failed to set up mount namespacing: /run/systemd/ unit-root/run/secubox: No such file or directory` at the NAMESPACE step. Root cause: 96 services declare `RuntimeDirectory=secubox` without the matching `RuntimeDirectoryPreserve=yes`. When any of them stops (including any of the LXC-backed services that fail their health probe and Restart=on-failure for a few cycles), systemd removes /run/secubox on the way out. The next service with the same RuntimeDirectory= that tries to namespace its inputs hits the gap and falls into 226/NAMESPACE failure — Restart hammers a few times, then the unit goes failed-permanent. Earlier fmrelay + sentinelle units got the fix individually (v2.12.0/v2.12.3 era). Now applied to all 96 remaining units in a single sweep via: sed -i '/^RuntimeDirectory=secubox/a RuntimeDirectoryPreserve=yes' "$f" No version bumps in changelog — `dpkg -i --force-depends` in the live-USB slipstream picks up the new .deb regardless of version number. --- packages/secubox-ad-guard/debian/secubox-ad-guard.service | 1 + packages/secubox-admin/debian/secubox-admin.service | 1 + packages/secubox-ai-gateway/debian/secubox-ai-gateway.service | 1 + packages/secubox-ai-insights/systemd/secubox-ai-insights.service | 1 + packages/secubox-auth/debian/secubox-auth.service | 1 + packages/secubox-avatar/debian/secubox-avatar.service | 1 + packages/secubox-backup/debian/secubox-backup.service | 1 + packages/secubox-c3box/debian/secubox-c3box.service | 1 + packages/secubox-cdn/debian/secubox-cdn.service | 1 + .../secubox-config-advisor/debian/secubox-config-advisor.service | 1 + packages/secubox-crowdsec/debian/secubox-crowdsec.service | 1 + packages/secubox-cve-triage/debian/secubox-cve-triage.service | 1 + packages/secubox-cyberfeed/debian/secubox-cyberfeed.service | 1 + .../secubox-device-intel/debian/secubox-device-intel.service | 1 + packages/secubox-dns-guard/debian/secubox-dns-guard.service | 1 + .../secubox-dns-provider/debian/secubox-dns-provider.service | 1 + .../secubox-dns-provider/systemd/secubox-dns-provider.service | 1 + packages/secubox-dns/debian/secubox-dns.service | 1 + packages/secubox-droplet/debian/secubox-droplet.service | 1 + packages/secubox-eye-remote/debian/secubox-eye-remote.service | 1 + packages/secubox-gitea/debian/secubox-gitea.service | 1 + packages/secubox-glances/debian/secubox-glances.service | 1 + packages/secubox-haproxy/debian/secubox-haproxy.service | 1 + packages/secubox-hardening/debian/secubox-hardening.service | 1 + packages/secubox-hub/debian/secubox-hub.service | 1 + packages/secubox-identity/debian/secubox-identity.service | 1 + packages/secubox-interceptor/systemd/secubox-interceptor.service | 1 + packages/secubox-iot-guard/debian/secubox-iot-guard.service | 1 + packages/secubox-ipblock/debian/secubox-ipblock.service | 1 + packages/secubox-ipblock/systemd/secubox-ipblock.service | 1 + packages/secubox-jitsi/systemd/secubox-jitsi.service | 1 + packages/secubox-ksm/debian/secubox-ksm.service | 1 + packages/secubox-localrecall/debian/secubox-localrecall.service | 1 + packages/secubox-mac-guard/systemd/secubox-mac-guard.service | 1 + packages/secubox-mail-lxc/debian/secubox-mail-lxc.service | 1 + packages/secubox-master-link/debian/secubox-master-link.service | 1 + packages/secubox-matrix/debian/secubox-matrix.service | 1 + packages/secubox-matrix/systemd/secubox-matrix.service | 1 + packages/secubox-mcp-server/debian/secubox-mcp-server.service | 1 + packages/secubox-mediaflow/debian/secubox-mediaflow.service | 1 + packages/secubox-mesh/debian/secubox-mesh.service | 1 + packages/secubox-meshname/debian/secubox-meshname.service | 1 + packages/secubox-metabolizer/debian/secubox-metabolizer.service | 1 + packages/secubox-metacatalog/debian/secubox-metacatalog.service | 1 + packages/secubox-metoblizer/debian/secubox-metoblizer.service | 1 + packages/secubox-mirror/debian/secubox-mirror.service | 1 + packages/secubox-modem/debian/secubox-modem.service | 1 + packages/secubox-modem/systemd/secubox-modem.service | 1 + packages/secubox-nac/debian/secubox-nac.service | 1 + packages/secubox-ndpid/debian/secubox-ndpid.service | 1 + packages/secubox-netdata/debian/secubox-netdata.service | 1 + packages/secubox-netdiag/debian/secubox-netdiag.service | 1 + packages/secubox-nettweak/debian/secubox-nettweak.service | 1 + .../debian/secubox-network-anomaly.service | 1 + packages/secubox-nextcloud/debian/secubox-nextcloud.service | 1 + packages/secubox-p2p/debian/secubox-p2p.service | 1 + packages/secubox-publish/debian/secubox-publish.service | 1 + packages/secubox-repo/debian/secubox-repo.service | 1 + packages/secubox-reporter/debian/secubox-reporter.service | 1 + packages/secubox-roadmap/debian/secubox-roadmap.service | 1 + packages/secubox-routes/debian/secubox-routes.service | 1 + packages/secubox-rtty/debian/secubox-rtty.service | 1 + packages/secubox-saas-relay/debian/secubox-saas-relay.service | 1 + packages/secubox-simplex/debian/secubox-simplex.service | 1 + packages/secubox-smtp-relay/debian/secubox-smtp-relay.service | 1 + packages/secubox-soc-agent/debian/secubox-soc-agent.service | 1 + packages/secubox-soc-gateway/debian/secubox-soc-gateway.service | 1 + packages/secubox-soc/debian/secubox-soc.service | 1 + packages/secubox-streamforge/debian/secubox-streamforge.service | 1 + packages/secubox-streamlit/debian/secubox-streamlit.service | 1 + packages/secubox-system/debian/secubox-system.service | 1 + .../secubox-threat-analyst/debian/secubox-threat-analyst.service | 1 + packages/secubox-threats/systemd/secubox-threats.service | 1 + packages/secubox-tor/debian/secubox-tor.service | 1 + packages/secubox-torrent/systemd/secubox-torrent.service | 1 + packages/secubox-turn/debian/secubox-turn.service | 1 + packages/secubox-users/debian/secubox-users.service | 1 + packages/secubox-vhost/debian/secubox-vhost.service | 1 + packages/secubox-voip/systemd/secubox-voip.service | 1 + packages/secubox-vortex-dns/debian/secubox-vortex-dns.service | 1 + .../debian/secubox-vortex-firewall.service | 1 + packages/secubox-waf/debian/secubox-waf.service | 1 + packages/secubox-watchdog/debian/secubox-watchdog.service | 1 + packages/secubox-webmail-lxc/debian/secubox-webmail-lxc.service | 1 + packages/secubox-webmail/debian/secubox-webmail.service | 1 + packages/secubox-wireguard/debian/secubox-wireguard.service | 1 + packages/secubox-zkp/debian/secubox-zkp.service | 1 + 87 files changed, 87 insertions(+) diff --git a/packages/secubox-ad-guard/debian/secubox-ad-guard.service b/packages/secubox-ad-guard/debian/secubox-ad-guard.service index d32a85a0..f22c7ee5 100644 --- a/packages/secubox-ad-guard/debian/secubox-ad-guard.service +++ b/packages/secubox-ad-guard/debian/secubox-ad-guard.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-admin/debian/secubox-admin.service b/packages/secubox-admin/debian/secubox-admin.service index b60e8148..4e1ef989 100644 --- a/packages/secubox-admin/debian/secubox-admin.service +++ b/packages/secubox-admin/debian/secubox-admin.service @@ -16,6 +16,7 @@ Restart=on-failure RestartSec=5 PrivateTmp=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 [Install] diff --git a/packages/secubox-ai-gateway/debian/secubox-ai-gateway.service b/packages/secubox-ai-gateway/debian/secubox-ai-gateway.service index e7359945..ef57def9 100644 --- a/packages/secubox-ai-gateway/debian/secubox-ai-gateway.service +++ b/packages/secubox-ai-gateway/debian/secubox-ai-gateway.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-ai-insights/systemd/secubox-ai-insights.service b/packages/secubox-ai-insights/systemd/secubox-ai-insights.service index 87cb4fec..6e066d59 100644 --- a/packages/secubox-ai-insights/systemd/secubox-ai-insights.service +++ b/packages/secubox-ai-insights/systemd/secubox-ai-insights.service @@ -17,6 +17,7 @@ RestartSec=5 PrivateTmp=true NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ProtectSystem=full ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox diff --git a/packages/secubox-auth/debian/secubox-auth.service b/packages/secubox-auth/debian/secubox-auth.service index 8f094220..eebf9e0e 100644 --- a/packages/secubox-auth/debian/secubox-auth.service +++ b/packages/secubox-auth/debian/secubox-auth.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-avatar/debian/secubox-avatar.service b/packages/secubox-avatar/debian/secubox-avatar.service index 1205587b..72fef0ef 100644 --- a/packages/secubox-avatar/debian/secubox-avatar.service +++ b/packages/secubox-avatar/debian/secubox-avatar.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-backup/debian/secubox-backup.service b/packages/secubox-backup/debian/secubox-backup.service index a4f456f8..de91b1b0 100644 --- a/packages/secubox-backup/debian/secubox-backup.service +++ b/packages/secubox-backup/debian/secubox-backup.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-c3box/debian/secubox-c3box.service b/packages/secubox-c3box/debian/secubox-c3box.service index 0ac1daf9..49442723 100644 --- a/packages/secubox-c3box/debian/secubox-c3box.service +++ b/packages/secubox-c3box/debian/secubox-c3box.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-cdn/debian/secubox-cdn.service b/packages/secubox-cdn/debian/secubox-cdn.service index da9efe6e..29db7db4 100644 --- a/packages/secubox-cdn/debian/secubox-cdn.service +++ b/packages/secubox-cdn/debian/secubox-cdn.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-config-advisor/debian/secubox-config-advisor.service b/packages/secubox-config-advisor/debian/secubox-config-advisor.service index b8d85906..fb0d0349 100644 --- a/packages/secubox-config-advisor/debian/secubox-config-advisor.service +++ b/packages/secubox-config-advisor/debian/secubox-config-advisor.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-crowdsec/debian/secubox-crowdsec.service b/packages/secubox-crowdsec/debian/secubox-crowdsec.service index 314cced4..dfe094bf 100644 --- a/packages/secubox-crowdsec/debian/secubox-crowdsec.service +++ b/packages/secubox-crowdsec/debian/secubox-crowdsec.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-cve-triage/debian/secubox-cve-triage.service b/packages/secubox-cve-triage/debian/secubox-cve-triage.service index 3e63ef4c..bf18c6d0 100644 --- a/packages/secubox-cve-triage/debian/secubox-cve-triage.service +++ b/packages/secubox-cve-triage/debian/secubox-cve-triage.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-cyberfeed/debian/secubox-cyberfeed.service b/packages/secubox-cyberfeed/debian/secubox-cyberfeed.service index 154d6e67..d1d9d387 100644 --- a/packages/secubox-cyberfeed/debian/secubox-cyberfeed.service +++ b/packages/secubox-cyberfeed/debian/secubox-cyberfeed.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-device-intel/debian/secubox-device-intel.service b/packages/secubox-device-intel/debian/secubox-device-intel.service index ef963500..b6e6360a 100644 --- a/packages/secubox-device-intel/debian/secubox-device-intel.service +++ b/packages/secubox-device-intel/debian/secubox-device-intel.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-dns-guard/debian/secubox-dns-guard.service b/packages/secubox-dns-guard/debian/secubox-dns-guard.service index 77e0e67e..9c6125ab 100644 --- a/packages/secubox-dns-guard/debian/secubox-dns-guard.service +++ b/packages/secubox-dns-guard/debian/secubox-dns-guard.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-dns-provider/debian/secubox-dns-provider.service b/packages/secubox-dns-provider/debian/secubox-dns-provider.service index 3de4b424..9ffc57ab 100644 --- a/packages/secubox-dns-provider/debian/secubox-dns-provider.service +++ b/packages/secubox-dns-provider/debian/secubox-dns-provider.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-dns-provider/systemd/secubox-dns-provider.service b/packages/secubox-dns-provider/systemd/secubox-dns-provider.service index 22c74b55..bdeddd45 100644 --- a/packages/secubox-dns-provider/systemd/secubox-dns-provider.service +++ b/packages/secubox-dns-provider/systemd/secubox-dns-provider.service @@ -15,6 +15,7 @@ UMask=0000 PrivateTmp=true NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ProtectSystem=full ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox diff --git a/packages/secubox-dns/debian/secubox-dns.service b/packages/secubox-dns/debian/secubox-dns.service index eef35b96..7308545b 100644 --- a/packages/secubox-dns/debian/secubox-dns.service +++ b/packages/secubox-dns/debian/secubox-dns.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-droplet/debian/secubox-droplet.service b/packages/secubox-droplet/debian/secubox-droplet.service index 1a7628d2..e2b8541a 100644 --- a/packages/secubox-droplet/debian/secubox-droplet.service +++ b/packages/secubox-droplet/debian/secubox-droplet.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /srv/droplet diff --git a/packages/secubox-eye-remote/debian/secubox-eye-remote.service b/packages/secubox-eye-remote/debian/secubox-eye-remote.service index 9dd277ce..c800512c 100644 --- a/packages/secubox-eye-remote/debian/secubox-eye-remote.service +++ b/packages/secubox-eye-remote/debian/secubox-eye-remote.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-gitea/debian/secubox-gitea.service b/packages/secubox-gitea/debian/secubox-gitea.service index 3a17c152..4475f9c7 100644 --- a/packages/secubox-gitea/debian/secubox-gitea.service +++ b/packages/secubox-gitea/debian/secubox-gitea.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-glances/debian/secubox-glances.service b/packages/secubox-glances/debian/secubox-glances.service index 74825814..cb1af811 100644 --- a/packages/secubox-glances/debian/secubox-glances.service +++ b/packages/secubox-glances/debian/secubox-glances.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-haproxy/debian/secubox-haproxy.service b/packages/secubox-haproxy/debian/secubox-haproxy.service index 5b26876c..e31b44e5 100644 --- a/packages/secubox-haproxy/debian/secubox-haproxy.service +++ b/packages/secubox-haproxy/debian/secubox-haproxy.service @@ -23,6 +23,7 @@ StartLimitBurst=5 # ProtectSystem=full NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 # ReadWritePaths removed - causes NAMESPACE errors when haproxy not installed # (haproxy is Recommends, not Depends - /etc/haproxy may not exist) diff --git a/packages/secubox-hardening/debian/secubox-hardening.service b/packages/secubox-hardening/debian/secubox-hardening.service index 3f27b0b8..f8417e3a 100644 --- a/packages/secubox-hardening/debian/secubox-hardening.service +++ b/packages/secubox-hardening/debian/secubox-hardening.service @@ -16,6 +16,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /etc/sysctl.d /etc/modprobe.d diff --git a/packages/secubox-hub/debian/secubox-hub.service b/packages/secubox-hub/debian/secubox-hub.service index 9d9fc830..ad729e99 100644 --- a/packages/secubox-hub/debian/secubox-hub.service +++ b/packages/secubox-hub/debian/secubox-hub.service @@ -23,6 +23,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 LogsDirectory=secubox LogsDirectoryMode=0755 diff --git a/packages/secubox-identity/debian/secubox-identity.service b/packages/secubox-identity/debian/secubox-identity.service index 45f5ce57..7288a563 100644 --- a/packages/secubox-identity/debian/secubox-identity.service +++ b/packages/secubox-identity/debian/secubox-identity.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-interceptor/systemd/secubox-interceptor.service b/packages/secubox-interceptor/systemd/secubox-interceptor.service index 1c26182e..654359ea 100644 --- a/packages/secubox-interceptor/systemd/secubox-interceptor.service +++ b/packages/secubox-interceptor/systemd/secubox-interceptor.service @@ -13,6 +13,7 @@ Restart=on-failure RestartSec=5 PrivateTmp=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes [Install] WantedBy=multi-user.target diff --git a/packages/secubox-iot-guard/debian/secubox-iot-guard.service b/packages/secubox-iot-guard/debian/secubox-iot-guard.service index afab4dcd..a017a0dd 100644 --- a/packages/secubox-iot-guard/debian/secubox-iot-guard.service +++ b/packages/secubox-iot-guard/debian/secubox-iot-guard.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-ipblock/debian/secubox-ipblock.service b/packages/secubox-ipblock/debian/secubox-ipblock.service index 6a9016dc..6769c427 100644 --- a/packages/secubox-ipblock/debian/secubox-ipblock.service +++ b/packages/secubox-ipblock/debian/secubox-ipblock.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/nftables.d diff --git a/packages/secubox-ipblock/systemd/secubox-ipblock.service b/packages/secubox-ipblock/systemd/secubox-ipblock.service index 9bd150eb..c430f75a 100644 --- a/packages/secubox-ipblock/systemd/secubox-ipblock.service +++ b/packages/secubox-ipblock/systemd/secubox-ipblock.service @@ -15,6 +15,7 @@ UMask=0000 PrivateTmp=true NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ProtectSystem=full ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/nftables.d diff --git a/packages/secubox-jitsi/systemd/secubox-jitsi.service b/packages/secubox-jitsi/systemd/secubox-jitsi.service index 2a91e7f0..9e92f474 100644 --- a/packages/secubox-jitsi/systemd/secubox-jitsi.service +++ b/packages/secubox-jitsi/systemd/secubox-jitsi.service @@ -19,6 +19,7 @@ Restart=on-failure RestartSec=5 PrivateTmp=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 [Install] diff --git a/packages/secubox-ksm/debian/secubox-ksm.service b/packages/secubox-ksm/debian/secubox-ksm.service index b142cb88..bd54d1b3 100644 --- a/packages/secubox-ksm/debian/secubox-ksm.service +++ b/packages/secubox-ksm/debian/secubox-ksm.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=false RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /sys/kernel/mm/ksm diff --git a/packages/secubox-localrecall/debian/secubox-localrecall.service b/packages/secubox-localrecall/debian/secubox-localrecall.service index d69da38f..63e14309 100644 --- a/packages/secubox-localrecall/debian/secubox-localrecall.service +++ b/packages/secubox-localrecall/debian/secubox-localrecall.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-mac-guard/systemd/secubox-mac-guard.service b/packages/secubox-mac-guard/systemd/secubox-mac-guard.service index 77a28488..baef81b2 100644 --- a/packages/secubox-mac-guard/systemd/secubox-mac-guard.service +++ b/packages/secubox-mac-guard/systemd/secubox-mac-guard.service @@ -17,6 +17,7 @@ RestartSec=5 PrivateTmp=true NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ProtectSystem=full ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox diff --git a/packages/secubox-mail-lxc/debian/secubox-mail-lxc.service b/packages/secubox-mail-lxc/debian/secubox-mail-lxc.service index 3d91c946..ad9fb248 100644 --- a/packages/secubox-mail-lxc/debian/secubox-mail-lxc.service +++ b/packages/secubox-mail-lxc/debian/secubox-mail-lxc.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-master-link/debian/secubox-master-link.service b/packages/secubox-master-link/debian/secubox-master-link.service index 4c8bdc66..9bb21056 100644 --- a/packages/secubox-master-link/debian/secubox-master-link.service +++ b/packages/secubox-master-link/debian/secubox-master-link.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-matrix/debian/secubox-matrix.service b/packages/secubox-matrix/debian/secubox-matrix.service index a7403fb9..d4425442 100644 --- a/packages/secubox-matrix/debian/secubox-matrix.service +++ b/packages/secubox-matrix/debian/secubox-matrix.service @@ -19,6 +19,7 @@ RestartSec=5 NoNewPrivileges=false RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /var/lib/lxc diff --git a/packages/secubox-matrix/systemd/secubox-matrix.service b/packages/secubox-matrix/systemd/secubox-matrix.service index 41afad55..6b153f23 100644 --- a/packages/secubox-matrix/systemd/secubox-matrix.service +++ b/packages/secubox-matrix/systemd/secubox-matrix.service @@ -19,6 +19,7 @@ RestartSec=5 PrivateTmp=true NoNewPrivileges=false RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ProtectSystem=full ReadWritePaths=/run/secubox /var/lib/secubox /var/lib/lxc diff --git a/packages/secubox-mcp-server/debian/secubox-mcp-server.service b/packages/secubox-mcp-server/debian/secubox-mcp-server.service index e730d547..2d2eefff 100644 --- a/packages/secubox-mcp-server/debian/secubox-mcp-server.service +++ b/packages/secubox-mcp-server/debian/secubox-mcp-server.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-mediaflow/debian/secubox-mediaflow.service b/packages/secubox-mediaflow/debian/secubox-mediaflow.service index 0c03ec02..17c111ae 100644 --- a/packages/secubox-mediaflow/debian/secubox-mediaflow.service +++ b/packages/secubox-mediaflow/debian/secubox-mediaflow.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-mesh/debian/secubox-mesh.service b/packages/secubox-mesh/debian/secubox-mesh.service index 77bf41e0..b2a46d5f 100644 --- a/packages/secubox-mesh/debian/secubox-mesh.service +++ b/packages/secubox-mesh/debian/secubox-mesh.service @@ -8,6 +8,7 @@ Type=simple User=secubox Group=secubox RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes WorkingDirectory=/usr/lib/secubox/mesh ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/mesh.sock --workers 1 Restart=always diff --git a/packages/secubox-meshname/debian/secubox-meshname.service b/packages/secubox-meshname/debian/secubox-meshname.service index a5eda476..7f344e20 100644 --- a/packages/secubox-meshname/debian/secubox-meshname.service +++ b/packages/secubox-meshname/debian/secubox-meshname.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-metabolizer/debian/secubox-metabolizer.service b/packages/secubox-metabolizer/debian/secubox-metabolizer.service index 6eacf1aa..3732a45e 100644 --- a/packages/secubox-metabolizer/debian/secubox-metabolizer.service +++ b/packages/secubox-metabolizer/debian/secubox-metabolizer.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox diff --git a/packages/secubox-metacatalog/debian/secubox-metacatalog.service b/packages/secubox-metacatalog/debian/secubox-metacatalog.service index e6f58e3e..3ac2339d 100644 --- a/packages/secubox-metacatalog/debian/secubox-metacatalog.service +++ b/packages/secubox-metacatalog/debian/secubox-metacatalog.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox diff --git a/packages/secubox-metoblizer/debian/secubox-metoblizer.service b/packages/secubox-metoblizer/debian/secubox-metoblizer.service index 77c4ae61..ca4d8d79 100644 --- a/packages/secubox-metoblizer/debian/secubox-metoblizer.service +++ b/packages/secubox-metoblizer/debian/secubox-metoblizer.service @@ -11,6 +11,7 @@ ExecStart=/usr/bin/uvicorn api.main:app --uds /run/secubox/metoblizer.sock --wor Restart=on-failure RestartSec=5 RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes StateDirectory=secubox/metoblizer [Install] diff --git a/packages/secubox-mirror/debian/secubox-mirror.service b/packages/secubox-mirror/debian/secubox-mirror.service index 7ce656f7..b513991e 100644 --- a/packages/secubox-mirror/debian/secubox-mirror.service +++ b/packages/secubox-mirror/debian/secubox-mirror.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox-mirror /etc/secubox /etc/nginx/secubox-mirror.d diff --git a/packages/secubox-modem/debian/secubox-modem.service b/packages/secubox-modem/debian/secubox-modem.service index 8ec127ea..5655668d 100644 --- a/packages/secubox-modem/debian/secubox-modem.service +++ b/packages/secubox-modem/debian/secubox-modem.service @@ -19,6 +19,7 @@ RestartSec=5 # Security NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 # Allow access to serial ports and modem devices diff --git a/packages/secubox-modem/systemd/secubox-modem.service b/packages/secubox-modem/systemd/secubox-modem.service index 8ec127ea..5655668d 100644 --- a/packages/secubox-modem/systemd/secubox-modem.service +++ b/packages/secubox-modem/systemd/secubox-modem.service @@ -19,6 +19,7 @@ RestartSec=5 # Security NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 # Allow access to serial ports and modem devices diff --git a/packages/secubox-nac/debian/secubox-nac.service b/packages/secubox-nac/debian/secubox-nac.service index 6b4d7013..f2a21f1b 100644 --- a/packages/secubox-nac/debian/secubox-nac.service +++ b/packages/secubox-nac/debian/secubox-nac.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-ndpid/debian/secubox-ndpid.service b/packages/secubox-ndpid/debian/secubox-ndpid.service index 2d063379..6961c6e7 100644 --- a/packages/secubox-ndpid/debian/secubox-ndpid.service +++ b/packages/secubox-ndpid/debian/secubox-ndpid.service @@ -16,6 +16,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /run/ndpid diff --git a/packages/secubox-netdata/debian/secubox-netdata.service b/packages/secubox-netdata/debian/secubox-netdata.service index 15438cc5..bdb2aa7e 100644 --- a/packages/secubox-netdata/debian/secubox-netdata.service +++ b/packages/secubox-netdata/debian/secubox-netdata.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-netdiag/debian/secubox-netdiag.service b/packages/secubox-netdiag/debian/secubox-netdiag.service index b75193ff..9fd5be95 100644 --- a/packages/secubox-netdiag/debian/secubox-netdiag.service +++ b/packages/secubox-netdiag/debian/secubox-netdiag.service @@ -16,6 +16,7 @@ Restart=on-failure RestartSec=5 RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox diff --git a/packages/secubox-nettweak/debian/secubox-nettweak.service b/packages/secubox-nettweak/debian/secubox-nettweak.service index 9b3ee277..45567e5a 100644 --- a/packages/secubox-nettweak/debian/secubox-nettweak.service +++ b/packages/secubox-nettweak/debian/secubox-nettweak.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=false RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/sysctl.d /proc/sys diff --git a/packages/secubox-network-anomaly/debian/secubox-network-anomaly.service b/packages/secubox-network-anomaly/debian/secubox-network-anomaly.service index 8b6f4288..9b5ab170 100644 --- a/packages/secubox-network-anomaly/debian/secubox-network-anomaly.service +++ b/packages/secubox-network-anomaly/debian/secubox-network-anomaly.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-nextcloud/debian/secubox-nextcloud.service b/packages/secubox-nextcloud/debian/secubox-nextcloud.service index 6c257dd3..fd35873b 100644 --- a/packages/secubox-nextcloud/debian/secubox-nextcloud.service +++ b/packages/secubox-nextcloud/debian/secubox-nextcloud.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-p2p/debian/secubox-p2p.service b/packages/secubox-p2p/debian/secubox-p2p.service index 1575b44b..ff166cf8 100644 --- a/packages/secubox-p2p/debian/secubox-p2p.service +++ b/packages/secubox-p2p/debian/secubox-p2p.service @@ -8,6 +8,7 @@ Type=simple User=secubox Group=secubox RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/p2p.sock --workers 1 WorkingDirectory=/usr/lib/secubox/p2p Restart=on-failure diff --git a/packages/secubox-publish/debian/secubox-publish.service b/packages/secubox-publish/debian/secubox-publish.service index 020c41a1..c2e72bee 100644 --- a/packages/secubox-publish/debian/secubox-publish.service +++ b/packages/secubox-publish/debian/secubox-publish.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-repo/debian/secubox-repo.service b/packages/secubox-repo/debian/secubox-repo.service index 000747ce..516bd272 100644 --- a/packages/secubox-repo/debian/secubox-repo.service +++ b/packages/secubox-repo/debian/secubox-repo.service @@ -18,6 +18,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox-repo /var/www/apt.secubox.in /tmp diff --git a/packages/secubox-reporter/debian/secubox-reporter.service b/packages/secubox-reporter/debian/secubox-reporter.service index 1416270a..b5e0993a 100644 --- a/packages/secubox-reporter/debian/secubox-reporter.service +++ b/packages/secubox-reporter/debian/secubox-reporter.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox diff --git a/packages/secubox-roadmap/debian/secubox-roadmap.service b/packages/secubox-roadmap/debian/secubox-roadmap.service index 8c986036..ab06cb6d 100644 --- a/packages/secubox-roadmap/debian/secubox-roadmap.service +++ b/packages/secubox-roadmap/debian/secubox-roadmap.service @@ -8,6 +8,7 @@ Type=simple User=secubox Group=secubox RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes WorkingDirectory=/usr/lib/secubox/roadmap ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/roadmap.sock --workers 1 Restart=always diff --git a/packages/secubox-routes/debian/secubox-routes.service b/packages/secubox-routes/debian/secubox-routes.service index 4572bc8d..b2b94371 100644 --- a/packages/secubox-routes/debian/secubox-routes.service +++ b/packages/secubox-routes/debian/secubox-routes.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-rtty/debian/secubox-rtty.service b/packages/secubox-rtty/debian/secubox-rtty.service index 16ee2c6f..5b3c1eff 100644 --- a/packages/secubox-rtty/debian/secubox-rtty.service +++ b/packages/secubox-rtty/debian/secubox-rtty.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/rtty /var/log/rtty /var/log/secubox diff --git a/packages/secubox-saas-relay/debian/secubox-saas-relay.service b/packages/secubox-saas-relay/debian/secubox-saas-relay.service index d77a2ec7..08c3f9c2 100644 --- a/packages/secubox-saas-relay/debian/secubox-saas-relay.service +++ b/packages/secubox-saas-relay/debian/secubox-saas-relay.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/cache/secubox diff --git a/packages/secubox-simplex/debian/secubox-simplex.service b/packages/secubox-simplex/debian/secubox-simplex.service index b6af70cf..9ab572ca 100644 --- a/packages/secubox-simplex/debian/secubox-simplex.service +++ b/packages/secubox-simplex/debian/secubox-simplex.service @@ -13,6 +13,7 @@ Group=root WorkingDirectory=/usr/lib/secubox/simplex ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/simplex.sock --log-level warning RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0755 UMask=0117 Restart=on-failure diff --git a/packages/secubox-smtp-relay/debian/secubox-smtp-relay.service b/packages/secubox-smtp-relay/debian/secubox-smtp-relay.service index 540c128f..4ca45e63 100644 --- a/packages/secubox-smtp-relay/debian/secubox-smtp-relay.service +++ b/packages/secubox-smtp-relay/debian/secubox-smtp-relay.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/postfix /var/log/mail.log diff --git a/packages/secubox-soc-agent/debian/secubox-soc-agent.service b/packages/secubox-soc-agent/debian/secubox-soc-agent.service index 9daea6e3..c4cb8caf 100644 --- a/packages/secubox-soc-agent/debian/secubox-soc-agent.service +++ b/packages/secubox-soc-agent/debian/secubox-soc-agent.service @@ -13,6 +13,7 @@ ExecReload=/bin/kill -HUP $MAINPID Restart=on-failure RestartSec=5 RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0755 # Security hardening diff --git a/packages/secubox-soc-gateway/debian/secubox-soc-gateway.service b/packages/secubox-soc-gateway/debian/secubox-soc-gateway.service index 609b1223..59fb818a 100644 --- a/packages/secubox-soc-gateway/debian/secubox-soc-gateway.service +++ b/packages/secubox-soc-gateway/debian/secubox-soc-gateway.service @@ -13,6 +13,7 @@ ExecReload=/bin/kill -HUP $MAINPID Restart=on-failure RestartSec=5 RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0755 # Security hardening diff --git a/packages/secubox-soc/debian/secubox-soc.service b/packages/secubox-soc/debian/secubox-soc.service index be00300e..e755e0d0 100644 --- a/packages/secubox-soc/debian/secubox-soc.service +++ b/packages/secubox-soc/debian/secubox-soc.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-streamforge/debian/secubox-streamforge.service b/packages/secubox-streamforge/debian/secubox-streamforge.service index 3accfbd9..f96c4c82 100644 --- a/packages/secubox-streamforge/debian/secubox-streamforge.service +++ b/packages/secubox-streamforge/debian/secubox-streamforge.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /srv/streamlit diff --git a/packages/secubox-streamlit/debian/secubox-streamlit.service b/packages/secubox-streamlit/debian/secubox-streamlit.service index b3aa2ffc..fc5c175f 100644 --- a/packages/secubox-streamlit/debian/secubox-streamlit.service +++ b/packages/secubox-streamlit/debian/secubox-streamlit.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /srv/streamlit diff --git a/packages/secubox-system/debian/secubox-system.service b/packages/secubox-system/debian/secubox-system.service index 9208840b..87d5ed2d 100644 --- a/packages/secubox-system/debian/secubox-system.service +++ b/packages/secubox-system/debian/secubox-system.service @@ -18,6 +18,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 LogsDirectory=secubox LogsDirectoryMode=0755 diff --git a/packages/secubox-threat-analyst/debian/secubox-threat-analyst.service b/packages/secubox-threat-analyst/debian/secubox-threat-analyst.service index 96ea3b6e..5b974bf6 100644 --- a/packages/secubox-threat-analyst/debian/secubox-threat-analyst.service +++ b/packages/secubox-threat-analyst/debian/secubox-threat-analyst.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-threats/systemd/secubox-threats.service b/packages/secubox-threats/systemd/secubox-threats.service index e798e106..102844fb 100644 --- a/packages/secubox-threats/systemd/secubox-threats.service +++ b/packages/secubox-threats/systemd/secubox-threats.service @@ -17,6 +17,7 @@ UMask=0000 # ProtectSystem=full NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/suricata /var/log/secubox diff --git a/packages/secubox-tor/debian/secubox-tor.service b/packages/secubox-tor/debian/secubox-tor.service index 6f2ffc15..218a435b 100644 --- a/packages/secubox-tor/debian/secubox-tor.service +++ b/packages/secubox-tor/debian/secubox-tor.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-torrent/systemd/secubox-torrent.service b/packages/secubox-torrent/systemd/secubox-torrent.service index e0983918..d416cefa 100644 --- a/packages/secubox-torrent/systemd/secubox-torrent.service +++ b/packages/secubox-torrent/systemd/secubox-torrent.service @@ -19,6 +19,7 @@ RestartSec=5 PrivateTmp=true NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ProtectSystem=full ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox /srv/torrent diff --git a/packages/secubox-turn/debian/secubox-turn.service b/packages/secubox-turn/debian/secubox-turn.service index a02a3a13..69f71f19 100644 --- a/packages/secubox-turn/debian/secubox-turn.service +++ b/packages/secubox-turn/debian/secubox-turn.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/turnserver.conf /var/log/turnserver /var/log/secubox diff --git a/packages/secubox-users/debian/secubox-users.service b/packages/secubox-users/debian/secubox-users.service index 8adbd76e..6c562ac0 100644 --- a/packages/secubox-users/debian/secubox-users.service +++ b/packages/secubox-users/debian/secubox-users.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-vhost/debian/secubox-vhost.service b/packages/secubox-vhost/debian/secubox-vhost.service index 44935571..bc5ffb69 100644 --- a/packages/secubox-vhost/debian/secubox-vhost.service +++ b/packages/secubox-vhost/debian/secubox-vhost.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-voip/systemd/secubox-voip.service b/packages/secubox-voip/systemd/secubox-voip.service index 4c8409c7..48d1e508 100644 --- a/packages/secubox-voip/systemd/secubox-voip.service +++ b/packages/secubox-voip/systemd/secubox-voip.service @@ -19,6 +19,7 @@ RestartSec=5 PrivateTmp=true NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ProtectSystem=full ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox /srv/voip diff --git a/packages/secubox-vortex-dns/debian/secubox-vortex-dns.service b/packages/secubox-vortex-dns/debian/secubox-vortex-dns.service index 3a9848ca..fbf4f18d 100644 --- a/packages/secubox-vortex-dns/debian/secubox-vortex-dns.service +++ b/packages/secubox-vortex-dns/debian/secubox-vortex-dns.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-vortex-firewall/debian/secubox-vortex-firewall.service b/packages/secubox-vortex-firewall/debian/secubox-vortex-firewall.service index fd614e84..9002a9e7 100644 --- a/packages/secubox-vortex-firewall/debian/secubox-vortex-firewall.service +++ b/packages/secubox-vortex-firewall/debian/secubox-vortex-firewall.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-waf/debian/secubox-waf.service b/packages/secubox-waf/debian/secubox-waf.service index 5c5c4ad5..ec1543f9 100644 --- a/packages/secubox-waf/debian/secubox-waf.service +++ b/packages/secubox-waf/debian/secubox-waf.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-watchdog/debian/secubox-watchdog.service b/packages/secubox-watchdog/debian/secubox-watchdog.service index 8bfad30f..9684ec02 100644 --- a/packages/secubox-watchdog/debian/secubox-watchdog.service +++ b/packages/secubox-watchdog/debian/secubox-watchdog.service @@ -14,6 +14,7 @@ RestartSec=5 UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 LogsDirectory=secubox LogsDirectoryMode=0755 diff --git a/packages/secubox-webmail-lxc/debian/secubox-webmail-lxc.service b/packages/secubox-webmail-lxc/debian/secubox-webmail-lxc.service index c5365819..c0e260d1 100644 --- a/packages/secubox-webmail-lxc/debian/secubox-webmail-lxc.service +++ b/packages/secubox-webmail-lxc/debian/secubox-webmail-lxc.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-webmail/debian/secubox-webmail.service b/packages/secubox-webmail/debian/secubox-webmail.service index 83625eea..ceb4f41d 100644 --- a/packages/secubox-webmail/debian/secubox-webmail.service +++ b/packages/secubox-webmail/debian/secubox-webmail.service @@ -15,6 +15,7 @@ UMask=0000 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/secubox diff --git a/packages/secubox-wireguard/debian/secubox-wireguard.service b/packages/secubox-wireguard/debian/secubox-wireguard.service index c84f60f1..0dbcae77 100644 --- a/packages/secubox-wireguard/debian/secubox-wireguard.service +++ b/packages/secubox-wireguard/debian/secubox-wireguard.service @@ -17,6 +17,7 @@ RestartSec=5 NoNewPrivileges=true RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0775 ReadWritePaths=/run/secubox /var/lib/secubox /etc/wireguard /var/log/secubox diff --git a/packages/secubox-zkp/debian/secubox-zkp.service b/packages/secubox-zkp/debian/secubox-zkp.service index 9f9a86ac..98c62cc2 100644 --- a/packages/secubox-zkp/debian/secubox-zkp.service +++ b/packages/secubox-zkp/debian/secubox-zkp.service @@ -9,6 +9,7 @@ User=secubox Group=secubox WorkingDirectory=/usr/lib/secubox/zkp RuntimeDirectory=secubox +RuntimeDirectoryPreserve=yes RuntimeDirectoryMode=0755 ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/zkp.sock Restart=always