[Unit]
Description=Enodia Sentinel - IDS/IPS/EDR agent
After=network.target
Documentation=https://github.com/Enodia/enodia-sentinel

[Service]
Type=simple
# /usr/bin/env resolves the launcher from PATH, so this works whether it was
# installed under /usr (package) or /usr/local (make install).
ExecStart=/usr/bin/env enodia-sentinel run
Restart=on-failure
RestartSec=5

# It only ever READS the system and WRITES to its own log dir. Lock the rest
# of the surface down: needs root to read every /proc and root-owned files,
# but with a minimal capability set and no ability to modify the system.
ProtectSystem=strict
ReadWritePaths=/var/log/enodia-sentinel
ProtectHome=read-only
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
LockPersonality=yes
RestrictNamespaces=yes
# CAP_SYS_PTRACE: read other processes' /proc; CAP_DAC_READ_SEARCH: read
# root-owned files (authorized_keys, ld.so.preload) regardless of perms.
CapabilityBoundingSet=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
AmbientCapabilities=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH

[Install]
WantedBy=multi-user.target