set PrivateTmp=true for puppetserver

theforeman · Nov 3, 2023 · ad6e23a · ad6e23a
1 parent 9f21a41
commit ad6e23a
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/manifests/server/puppetserver.pp b/manifests/server/puppetserver.pp
@@ -214,6 +214,13 @@
         unit     => 'puppetserver.service',
         content  => "[Service]\nLimitNOFILE=${max_open_files}\n",
       }
+
+      systemd::dropin_file { 'puppetserver.service-privatetmp.conf':
+        ensure   => $ensure_max_open_files,
+        filename => 'privatetmp.conf',
+        unit     => 'puppetserver.service',
+        content  => "[Service]\nPrivateTmp=true\n",
+      }
     } else {
       file_line { 'puppet::server::puppetserver::max_open_files':
         ensure => $ensure_max_open_files,