MINOR: systemd: Add SystemD's SystemCallFilter option to the unit file

This option takes away system calls that are unneeded for haproxy's
operation and thus is a good defense in depth measure.

diff --git a/contrib/systemd/haproxy.service.in b/contrib/systemd/haproxy.service.in
index 846bcc77f5eaa2b0851883c587ae2585a3a16c44..7a8b6bead2df23bc4e16e8edddfd0aacde454572 100644 (file)
--- a/contrib/systemd/haproxy.service.in
+++ b/contrib/systemd/haproxy.service.in
@@ -27,6 +27,8 @@ Type=notify
 # ProtectKernelTunables=true
 # ProtectKernelModules=true
 # ProtectControlGroups=true
+# If your SystemD version supports them, you can add: @reboot, @swap, @sync
+# SystemCallFilter=~@cpu-emulation @keyring @module @obsolete @raw-io
 
 [Install]
 WantedBy=multi-user.target