From 8121bcee7aa47080bbea2cf3e0e519ef4bb87bd5 Mon Sep 17 00:00:00 2001 From: Laurent GAY Date: Sun, 17 Dec 2023 17:18:46 +0100 Subject: [PATCH] correct systemd service --- conf/systemd.service | 34 ++++++++++++++++++++++++++++++++++ manifest.toml | 2 +- 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/conf/systemd.service b/conf/systemd.service index 9fa784a..5f2de3e 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -15,5 +15,39 @@ StandardError=inherit Restart=on-failure RestartSec=10 +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +# PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectClock=yes +ProtectHostname=yes +ProtectProc=invisible +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target diff --git a/manifest.toml b/manifest.toml index 4851301..37b8108 100644 --- a/manifest.toml +++ b/manifest.toml @@ -6,7 +6,7 @@ name = "Diacamma" description.en = "Management application for volunteers (association, condominium)" description.fr = "Application de gestion pour les bénévoles (association, copropriété)" -version = "23.12.16.17~ynh1" +version = "23.12.17.17~ynh1" maintainers = ["Laurent Gay"]