| [Unit] |
| Description=ASF Vulnogram instance for the CVE process |
| |
| [Service] |
| Type=simple |
| Environment=HOME=/opt/vulnogram-test |
| WorkingDirectory=/opt/vulnogram-test |
| ExecStart=/usr/bin/node app.js |
| Restart=always |
| PrivateTmp=yes |
| NoNewPrivileges=true |
| ProtectSystem=strict |
| RestrictNamespaces=uts ipc pid user cgroup |
| ProtectKernelTunables=yes |
| ProtectKernelModules=yes |
| PrivateDevices=yes |
| RestrictSUIDSGID=true |
| User=vulnogram |
| Group=vulnogram |
| TemporaryFileSystem=/ /nonexistent |
| BindReadOnlyPaths=/usr /bin /lib /opt/vulnogram-test |
| BindPaths=/var/spool/postfix/maildrop /var/spool/postfix/public |
| |
| [Install] |
| WantedBy=multi-user.target |
