From 4cc39328ba41cd95eb2c49753f3023444f4afce0 Mon Sep 17 00:00:00 2001 From: oufmilo <44617467+oufmilo@users.noreply.github.com> Date: Mon, 2 Jan 2023 16:52:07 +0100 Subject: [PATCH 1/4] Update bookwyrm-beat.service --- conf/bookwyrm-beat.service | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/conf/bookwyrm-beat.service b/conf/bookwyrm-beat.service index fd0adf1..49a1ba7 100644 --- a/conf/bookwyrm-beat.service +++ b/conf/bookwyrm-beat.service @@ -11,5 +11,35 @@ WorkingDirectory=__FINALPATH__/ EnvironmentFile=__FINALPATH__/.env ExecStart=__FINALPATH__/venv/bin/celery -A celerywyrm beat -l INFO --scheduler django_celery_beat.schedulers:DatabaseScheduler +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectClock=yes +ProtectHostname=yes +ProtectProc=invisible +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] -WantedBy=multi-user.target \ No newline at end of file +WantedBy=multi-user.target From 2f09afeb3717b9a92504cc551c54f1c7e5061c71 Mon Sep 17 00:00:00 2001 From: oufmilo <44617467+oufmilo@users.noreply.github.com> Date: Mon, 2 Jan 2023 16:52:29 +0100 Subject: [PATCH 2/4] Update bookwyrm-server.service --- conf/bookwyrm-server.service | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/conf/bookwyrm-server.service b/conf/bookwyrm-server.service index 0977449..fb9b151 100644 --- a/conf/bookwyrm-server.service +++ b/conf/bookwyrm-server.service @@ -11,5 +11,35 @@ WorkingDirectory=__FINALPATH__/ EnvironmentFile=__FINALPATH__/.env ExecStart=__FINALPATH__/venv/bin/gunicorn bookwyrm.wsgi:application --bind 0.0.0.0:__PORT__ +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectClock=yes +ProtectHostname=yes +ProtectProc=invisible +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] -WantedBy=multi-user.target \ No newline at end of file +WantedBy=multi-user.target From 59b47add04500ad7f63f8c58ce27b1ca28b85065 Mon Sep 17 00:00:00 2001 From: oufmilo <44617467+oufmilo@users.noreply.github.com> Date: Mon, 2 Jan 2023 16:52:49 +0100 Subject: [PATCH 3/4] Update bookwyrm-worker.service --- conf/bookwyrm-worker.service | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/conf/bookwyrm-worker.service b/conf/bookwyrm-worker.service index 7bc657d..6bec4bd 100644 --- a/conf/bookwyrm-worker.service +++ b/conf/bookwyrm-worker.service @@ -11,5 +11,35 @@ WorkingDirectory=__FINALPATH__/ EnvironmentFile=__FINALPATH__/.env ExecStart=__FINALPATH__/venv/bin/celery -A celerywyrm worker -l info -Q high_priority,medium_priority,low_priority +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectClock=yes +ProtectHostname=yes +ProtectProc=invisible +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] -WantedBy=multi-user.target \ No newline at end of file +WantedBy=multi-user.target From b47ba8a93e4db86d6876ac9af3469cc0ef0bd035 Mon Sep 17 00:00:00 2001 From: oufmilo <44617467+oufmilo@users.noreply.github.com> Date: Mon, 2 Jan 2023 16:55:34 +0100 Subject: [PATCH 4/4] Update manifest.json --- manifest.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/manifest.json b/manifest.json index 6bec448..dab66f3 100644 --- a/manifest.json +++ b/manifest.json @@ -3,8 +3,8 @@ "id": "bookwyrm", "packaging_format": 1, "description": { - "en": "BookWyrm is a platform for social reading.", - "fr": "BookWyrm est une plateforme de lecture sociale." + "en": "$app is a platform for social reading.", + "fr": "$app est une plateforme de lecture sociale." }, "version": "0.5.3~ynh1", "url": "https://github.com/bookwyrm-social/bookwyrm",