Make the runtime directory private

The status file contains sensitive information like filenames and duplicate chunk ranges. It might also make sense to set the process-wide `UMask=`, but that may have other unintended side effects.

diff --git a/scripts/beesd@.service.in b/scripts/beesd@.service.in
index e4bab3ca2c0c0dd7f82529d2c4544401b3563e36..32a6f85756d211a7f3a74fa5095332df9c63b360 100644 (file)
--- a/scripts/beesd@.service.in
+++ b/scripts/beesd@.service.in
@@ -17,6 +17,7 @@ KillSignal=SIGTERM
 MemoryAccounting=true
 Nice=19
 Restart=on-abnormal
+RuntimeDirectoryMode=0700
 RuntimeDirectory=bees
 StartupCPUWeight=25
 StartupIOWeight=25