pagecache-guard.service

[Unit]
Description=Page Cache Integrity Guard (fanotify + O_DIRECT)
Documentation=https://github.com/0xlane/pagecache-guard
After=local-fs.target

[Service]
Type=simple
ExecStart=/usr/bin/python3 -m pagecache_guard \
    --check-root \
    --watch-daemon crond,anacron,atd,systemd \
    --watch-file /etc/passwd /etc/profile /etc/ld.so.preload \
    --watch-pam /lib64/security \
    --watch-lib /lib64/libnss_files.so.2 /lib64/libpam.so.0 \
    --syslog \
    --log-file /var/log/pagecache-guard/guard.log \
    -- /usr /bin /sbin
WorkingDirectory=/opt/pagecache-guard
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal
SyslogIdentifier=pagecache-guard
LogsDirectory=pagecache-guard

# Hardening
# NOTE: ProtectHome/ProtectSystem create mount namespaces which break
# FAN_MARK_MOUNT — only use them if the kernel supports FAN_MARK_FILESYSTEM.
NoNewPrivileges=false
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_READ_SEARCH
AmbientCapabilities=CAP_SYS_ADMIN CAP_DAC_READ_SEARCH

[Install]
WantedBy=multi-user.target