File 1030-systemd-service-earlier.patch of Package opensnitch
Start firewall before network and harden service. Based on Debian patch by Petter Reinholdtsen: https://github.com/evilsocket/opensnitch/pull/1019 https://salsa.debian.org/pere/opensnitch - Start before network-pre.target instead of after network.target - Protect daemon from OOM killer (OOMScoreAdjust=-1000) - Use basic.target instead of multi-user.target --- a/utils/packaging/daemon/deb/debian/opensnitch.service +++ b/utils/packaging/daemon/deb/debian/opensnitch.service @@ -1,8 +1,10 @@ [Unit] -Description=Application firewall OpenSnitch +Description=OpenSnitch is a GNU/Linux application firewall. Documentation=https://github.com/evilsocket/opensnitch/wiki -Wants=network.target -After=network.target +DefaultDependencies=no +Before=network-pre.target shutdown.target +Wants=network-pre.target +Conflicts=shutdown.target [Service] Type=simple @@ -10,6 +12,8 @@ ExecStart=/usr/bin/opensnitchd Restart=always RestartSec=30 TimeoutStopSec=10 +OOMScoreAdjust=-1000 + [Install] -WantedBy=multi-user.target +WantedBy=basic.target