Внедрение KESL на ВМ2 + замена CLAMAV на KESL

2026-09-08 01:39:37 +03:00
parent 85df788f2d
commit fdfdeaffb4
43 changed files with 2210 additions and 329 deletions
@@ -0,0 +1,43 @@
+[Unit]
+Description=HAN local KESL scan broker
+Requires=han-kesl-scan-broker.socket
+After=kesl.service
+
+[Service]
+Type=simple
+User=root
+Group=han-message-safety
+ExecStart=/usr/local/libexec/han-kesl-scan-broker
+Environment=HAN_KESL_SCAN_TIMEOUT_SEC=60
+Environment=HAN_KESL_SCAN_CONCURRENCY=5
+StateDirectory=han-kesl-scan
+StateDirectoryMode=0700
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+ReadWritePaths=/var/lib/han-kesl-scan
+CapabilityBoundingSet=
+AmbientCapabilities=
+LimitCORE=0
+LimitNOFILE=128
+TasksMax=64
+MemoryMax=256M
+
+[Install]
+WantedBy=multi-user.target