From fbc224e061199d74dbc95bce57668c2ac4995192 Mon Sep 17 00:00:00 2001 From: tituspijean Date: Thu, 21 Oct 2021 16:58:15 +0200 Subject: [PATCH] Testing (#14) * [autopatch] Update issue and PR templates (#6) Co-authored-by: Yunohost-Bot <> * Update to tomcat 9.0.31-1~deb10u4 (#8) * Update to tomcat 9.0.31-1~deb10u4 - It is annoying that older builds are getting removed from source server - Let's rename the downloaded archive to simplify the code * Silence make warnings * Bump package version * Apply last example_ynh (#11) * Apply last example_ynh * Fix restore * Update tomcat9_deb.src * Update tomcat9_deb.src * Update the url and sum * Follow linter advice in manifest * Follow linter advice on chown * Follow linter advice on ynh_webpath_available * Appease linter on service security * Fix chown nobody Co-authored-by: YunoHost Bot Co-authored-by: yalh76 Co-authored-by: Jaime Marcos --- conf/guacd.service | 28 ++++++++++++++++++++++++++++ conf/tomcat9_deb.src | 4 ++-- manifest.json | 6 ++---- scripts/install | 4 ++-- scripts/restore | 6 ++---- scripts/upgrade | 4 ++-- 6 files changed, 38 insertions(+), 14 deletions(-) diff --git a/conf/guacd.service b/conf/guacd.service index ea1c52a..3b30a0f 100644 --- a/conf/guacd.service +++ b/conf/guacd.service @@ -11,5 +11,33 @@ Restart=on-abnormal Environment="LD_LIBRARY_PATH=__FINALPATH__/lib:__FINALPATH__/usr/lib" Environment="GUACAMOLE_HOME=__FINALPATH__/etc/guacamole" +# Sandboxing options to harden security +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target diff --git a/conf/tomcat9_deb.src b/conf/tomcat9_deb.src index ba35364..c7cf78a 100644 --- a/conf/tomcat9_deb.src +++ b/conf/tomcat9_deb.src @@ -1,5 +1,5 @@ -SOURCE_URL=https://ftp.debian.org/debian/pool/main/t/tomcat9/tomcat9_9.0.31-1~deb10u4_all.deb -SOURCE_SUM=42276CABAD11856553DD9265B8C7FBCCE245525BF80EAF180085AB74BB078619 +SOURCE_URL=https://ftp.debian.org/debian/pool/main/t/tomcat9/tomcat9_9.0.31-1~deb10u6_all.deb +SOURCE_SUM=9fc770b3cb32bacd22e6e48ea4539985173e523545f799dc207ea4316a8402e9 SOURCE_SUM_PRG=sha256sum SOURCE_FORMAT=ar SOURCE_IN_SUBDIR=false diff --git a/manifest.json b/manifest.json index 6ced031..a9fc38a 100644 --- a/manifest.json +++ b/manifest.json @@ -31,8 +31,7 @@ "install" : [ { "name": "domain", - "type": "domain", - "example": "example.com" + "type": "domain" }, { "name": "path", @@ -42,8 +41,7 @@ }, { "name": "admin", - "type": "user", - "example": "johndoe" + "type": "user" }, { "name": "is_public", diff --git a/scripts/install b/scripts/install index 89746af..82f2412 100755 --- a/scripts/install +++ b/scripts/install @@ -226,13 +226,13 @@ ynh_add_systemd_config --service="$app-tomcat" --template="tomcat.service" #================================================= # Set permissions to app files -chown -R root:root $final_path +chown -R nobody $final_path chmod -R o-rwx $final_path setfacl -n -R -m user:$app-guacd:rx -m default:user:$app-guacd:rx $final_path setfacl -n -R -m user:$app-tomcat:rx -m default:user:$app-tomcat:rx $final_path chown -R $app-guacd:$app-guacd "/var/log/$app/guacd/" chown -R $app-tomcat:$app-tomcat "/var/log/$app/tomcat/" -chown -R root:$app-tomcat "$final_path/etc/tomcat9/" "$final_path/etc/guacamole/" +chown -R nobody:$app-tomcat "$final_path/etc/tomcat9/" "$final_path/etc/guacamole/" chown -R "$app-tomcat":"$app-tomcat" "$final_path/var/lib/tomcat9/webapps" setfacl -n -R -m user:$app-guacd:- -m default:user:$app-guacd:- "$final_path/var/lib/tomcat9/" "$final_path/etc/guacamole/" "$final_path/etc/tomcat9/" diff --git a/scripts/restore b/scripts/restore index fccdf1d..2cb58bf 100755 --- a/scripts/restore +++ b/scripts/restore @@ -38,8 +38,6 @@ db_user=$db_name #================================================= ynh_script_progression --message="Validating restoration parameters..." --weight=1 -ynh_webpath_available --domain=$domain --path_url=$path_url \ - || ynh_die --message="Path not available: ${domain}${path_url}" test ! -d $final_path \ || ynh_die --message="There is already a directory: $final_path " @@ -110,11 +108,11 @@ fi #================================================= # Restore permissions on app files -chown -R root:root $final_path +chown -R nobody $final_path chmod -R o-rwx $final_path setfacl -n -R -m user:$app-guacd:rx -m default:user:$app-guacd:rx $final_path setfacl -n -R -m user:$app-tomcat:rx -m default:user:$app-tomcat:rx $final_path -chown -R root:$app-tomcat "$final_path/etc/tomcat9/" "$final_path/etc/guacamole/" +chown -R nobody:$app-tomcat "$final_path/etc/tomcat9/" "$final_path/etc/guacamole/" chown -R "$app-tomcat":"$app-tomcat" "$final_path/var/lib/tomcat9/webapps" setfacl -n -R -m user:$app-guacd:- -m default:user:$app-guacd:- "$final_path/var/lib/tomcat9/" "$final_path/etc/guacamole/" "$final_path/etc/tomcat9/" diff --git a/scripts/upgrade b/scripts/upgrade index f468777..8034f77 100644 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -201,13 +201,13 @@ ynh_add_systemd_config --service="$app-tomcat" --template="tomcat.service" #================================================= # Set permissions on app files -chown -R root:root $final_path +chown -R nobody $final_path chmod -R o-rwx $final_path setfacl -n -R -m user:$app-guacd:rx -m default:user:$app-guacd:rx $final_path setfacl -n -R -m user:$app-tomcat:rx -m default:user:$app-tomcat:rx $final_path chown -R $app-guacd:$app-guacd "/var/log/$app/guacd/" chown -R $app-tomcat:$app-tomcat "/var/log/$app/tomcat/" -chown -R root:$app-tomcat "$final_path/etc/tomcat9/" "$final_path/etc/guacamole/" +chown -R nobody:$app-tomcat "$final_path/etc/tomcat9/" "$final_path/etc/guacamole/" chown -R "$app-tomcat":"$app-tomcat" "$final_path/var/lib/tomcat9/webapps" setfacl -n -R -m user:$app-guacd:- -m default:user:$app-guacd:- "$final_path/var/lib/tomcat9/" "$final_path/etc/guacamole/" "$final_path/etc/tomcat9/"