amadan
deploy: hardening collector needs AF_NETLINK — its ufw/wg probes are netlink queries (#1171)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+5
−1
deploy/systemd/lchat-hardening.service+5 −1
diff --git a/deploy/systemd/lchat-hardening.service b/deploy/systemd/lchat-hardening.service| index 9d2720b..e754ff7 100644 |
| --- a/deploy/systemd/lchat-hardening.service |
| +++ b/deploy/systemd/lchat-hardening.service |
| @@ -30,7 +30,11 @@ ProtectKernelTunables=yes |
| ProtectKernelModules=yes |
| ProtectKernelLogs=yes |
| NoNewPrivileges=yes |
| -RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX |
| +# AF_NETLINK: `ufw status` and `ip link show wg0` are netlink queries — without |
| +# it both probes fail silently and the box publishes false "firewall inactive"/ |
| +# "wireguard absent" alarms (the dashboard's first real pass, 2026-07-19). |
| +# Read-only in effect: the collector never issues netlink writes. |
| +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK |
| RestrictNamespaces=yes |
| RestrictRealtime=yes |
| LockPersonality=yes |