[Unit]
Description=MultiScan isolated ClamAV and YARA scanner
After=local-fs.target
[Service]
Type=simple
User=multiscan-scanner
Group=multiscan
EnvironmentFile=/etc/multiscan/scanner.env
ExecStart=/usr/bin/python3 /opt/multiscan/scanner/daemon.py
RuntimeDirectory=multiscan
RuntimeDirectoryMode=0750
UMask=0007
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
PrivateNetwork=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
CapabilityBoundingSet=
RestrictAddressFamilies=AF_UNIX
ReadOnlyPaths=/var/lib/multiscan/quarantine /var/lib/clamav /etc/multiscan
ReadWritePaths=/run/multiscan
MemoryMax=3G
CPUQuota=150%
TasksMax=32
LimitNOFILE=256
LimitCORE=0
[Install]
WantedBy=multi-user.target