agent-tool-firewall/deploy/systemd/agent-tool-firewall.service at main · SecAI-Hub/agent-tool-firewall · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
[Unit]
Description=Agent Tool Firewall (default-deny policy gateway for LLM/agent tool calls)
After=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/agent-tool-firewall
Environment=BIND_ADDR=127.0.0.1:8475
Environment=POLICY_PATH=/etc/agent-tool-firewall/policy.yaml
Environment=AUDIT_LOG_PATH=/var/lib/agent-tool-firewall/audit.jsonl
Environment=SERVICE_TOKEN_PATH=/run/agent-tool-firewall/service-token

# Filesystem isolation
DynamicUser=yes
StateDirectory=agent-tool-firewall
LogsDirectory=agent-tool-firewall
ReadOnlyPaths=/etc/agent-tool-firewall
ReadWritePaths=/var/lib/agent-tool-firewall
PrivateNetwork=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectProc=invisible
ProcSubset=pid

# Kernel protection
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes

# Privilege restriction
NoNewPrivileges=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
LockPersonality=yes
RestrictRealtime=yes

# Capability bounding
CapabilityBoundingSet=
AmbientCapabilities=

# Namespace restrictions
RestrictNamespaces=yes
RestrictAddressFamilies=AF_UNIX
PrivateUsers=yes

# Syscall filtering
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources @mount @clock @debug @swap @reboot @raw-io @module @cpu-emulation @obsolete
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM

# Resource limits
MemoryMax=256M
CPUQuota=25%
TasksMax=32
LimitNOFILE=512
LimitCORE=0

Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target