WARNING: Now files and directories are created with the rights 0640 and 0750

This is a breaking change. I am not sure it's worth it.

WARNING: Now files and directories are created with the rights 0640 and 0750

This is a breaking change. I am not sure it's worth it.

Ok, removed this changes:

diff --git a/dist/mastodon-sidekiq.service b/dist/mastodon-sidekiq.service
index fc652b4e8..3ba13d03d 100644
--- a/dist/mastodon-sidekiq.service
+++ b/dist/mastodon-sidekiq.service
@@ -15,8 +15,6 @@ Restart=always
 # Proc filesystem
 ProcSubset=pid
 ProtectProc=invisible
-# Access write directories
-UMask=0027
 # Capabilities
 CapabilityBoundingSet=
 # Security
diff --git a/dist/mastodon-streaming.service b/dist/mastodon-streaming.service
index 36f9f8e75..861a7fe45 100644
--- a/dist/mastodon-streaming.service
+++ b/dist/mastodon-streaming.service
@@ -15,8 +15,6 @@ Restart=always
 # Proc filesystem
 ProcSubset=pid
 ProtectProc=invisible
-# Access write directories
-UMask=0027
 # Capabilities
 CapabilityBoundingSet=
 # Security
diff --git a/dist/mastodon-web.service b/dist/mastodon-web.service
index 465ac70fb..d083b8092 100644
--- a/dist/mastodon-web.service
+++ b/dist/mastodon-web.service
@@ -15,8 +15,6 @@ Restart=always
 # Proc filesystem
 ProcSubset=pid
 ProtectProc=invisible
-# Access write directories
-UMask=0027
 # Capabilities
 CapabilityBoundingSet=
 # Security

I am not sure about the implications of RemoveIPC here. Otherwise, it appears to work and allowing @resources actually fixes a bug with uploading media via /api/v1/media.

Generally, though, I'm not sure how much it's worth tightening the sandboxing settings, as it may cause hard-to-debug issues if we end up making more system calls or our dependencies change and make different system calls. Furthermore it may lead to hard-to-debug issues like #16378

Maybe there is an possibility to write tests that check the main functions in work?

Is there an issue that this references or addresses? Not being familiar with service flags, it would be nice to understand the problem(s) this solves.

Is there an issue that this references or addresses? Not being familiar with service flags, it would be nice to understand the problem(s) this solves.

Added ProcSubset, ProtectProc and RemoveIPC options.
Remoded duplicates filters. Filter @privileged includes the following filters - @chown, @clock, @module, @raw-io, @reboot, @swap.
To ruby process allow only @chown system calls instead @privileged
To service mastodon-streaming deny @memlock system calls.