set PrivateTmp=true for puppetserver

theforeman · Nov 6, 2023 · b2139a3 · b2139a3
1 parent b48699c
commit b2139a3
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/manifests/server/puppetserver.pp b/manifests/server/puppetserver.pp
@@ -214,6 +214,14 @@
         unit     => 'puppetserver.service',
         content  => "[Service]\nLimitNOFILE=${max_open_files}\n",
       }
+
+      # https://github.com/puppetlabs/ezbake/pull/623
+      systemd::dropin_file { 'puppetserver.service-privatetmp.conf':
+        ensure   => present,
+        filename => 'privatetmp.conf',
+        unit     => 'puppetserver.service',
+        content  => "[Service]\nPrivateTmp=true\n",
+      }
     } else {
       file_line { 'puppet::server::puppetserver::max_open_files':
         ensure => $ensure_max_open_files,