From 51247576f380319c47c6245c31445e0d4ee03b32 Mon Sep 17 00:00:00 2001
From: DuProcess <273172371+DuProcess@users.noreply.github.com>
Date: Sun, 28 Jun 2026 09:31:06 -0400
Subject: [PATCH] Harden server install restart path

---
 Makefile   |  1 +
 install.sh | 14 ++++++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 3aa3fe9..ea20bdc 100644
--- a/Makefile
+++ b/Makefile
@@ -14,6 +14,7 @@ clippy:
 
 release-check:
 	cargo fmt --check
+	sh -n install.sh scripts/*.sh
 	cargo clippy --all-targets -- -D warnings
 	cargo test
 	$(MAKE) tui-harness
diff --git a/install.sh b/install.sh
index 728f989..f1c40bf 100755
--- a/install.sh
+++ b/install.sh
@@ -410,7 +410,7 @@ write_systemd_service() {
   else
     cat >"$systemd_user_dir/dosh-server.service" <<EOF
 [Unit]
-Description=Dosh server
+Description=dosh dormant shell server
 After=network-online.target
 Wants=network-online.target
 
@@ -420,6 +420,15 @@ ExecStart=$bindir/dosh-server serve
 Restart=on-failure
 RestartSec=1
 KillMode=process
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=$config_dir $data_dir
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=default.target
@@ -479,7 +488,8 @@ EOF
     mkdir -p "$systemd_user_dir"
     write_systemd_service
     if [ "$start_server" -eq 1 ] && systemctl --user daemon-reload >/dev/null 2>&1; then
-      systemctl --user enable --now dosh-server.service
+      systemctl --user enable dosh-server.service
+      systemctl --user restart dosh-server.service
     fi
   elif [ "$start_server" -eq 1 ]; then
     nohup "$bindir/dosh-server" serve >"$data_dir/dosh-server.log" 2>&1 &