5172356
diff -ur suricata-4.1.1.orig/etc/suricata.service.in suricata-4.1.1/etc/suricata.service.in
5172356
--- suricata-4.1.1.orig/etc/suricata.service.in	2018-12-17 09:39:22.000000000 -0500
5172356
+++ suricata-4.1.1/etc/suricata.service.in	2018-12-17 12:50:15.490858743 -0500
cfb3b99
@@ -1,16 +1,23 @@
cfb3b99
 # Sample Suricata systemd unit file.
cfb3b99
 [Unit]
cfb3b99
 Description=Suricata Intrusion Detection Service
cfb3b99
-After=syslog.target network-online.target
cfb3b99
+After=syslog.target network-online.target systemd-tmpfiles-setup.service
cfb3b99
+Documentation=man:suricata(1)
cfb3b99
 
cfb3b99
 [Service]
cfb3b99
 # Environment file to pick up $OPTIONS. On Fedora/EL this would be
cfb3b99
 # /etc/sysconfig/suricata, or on Debian/Ubuntu, /etc/default/suricata.
cfb3b99
-#EnvironmentFile=-/etc/sysconfig/suricata
cfb3b99
+EnvironmentFile=-/etc/sysconfig/suricata
cfb3b99
 #EnvironmentFile=-/etc/default/suricata
5172356
 ExecStartPre=/bin/rm -f @e_rundir@suricata.pid
5172356
 ExecStart=/sbin/suricata -c @e_sysconfdir@suricata.yaml --pidfile @e_rundir@suricata.pid $OPTIONS
cfb3b99
 ExecReload=/bin/kill -USR2 $MAINPID
cfb3b99
 
cfb3b99
+### Security Settings ###
cfb3b99
+MemoryDenyWriteExecute=true
cfb3b99
+LockPersonality=true
cfb3b99
+ProtectControlGroups=true
cfb3b99
+ProtectKernelModules=true
cfb3b99
+
cfb3b99
 [Install]
cfb3b99
 WantedBy=multi-user.target