From 6bc858b8d26b9e5fd5cfae6811cfec4b04c0715c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89ric=20Gaspar?= <46165813+ericgaspar@users.noreply.github.com> Date: Fri, 13 Jan 2023 20:30:05 +0100 Subject: [PATCH 1/5] Fix linter --- conf/systemd.service | 34 ++++++++++++++++++++++++++++++++++ manifest.json | 4 ++-- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/conf/systemd.service b/conf/systemd.service index 5803179..76a2c0c 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -11,5 +11,39 @@ ExecStart=__FINALPATH__/venv/bin/gunicorn -c __FINALPATH__/gunicorn.conf.py ihat Restart=always RestartSec=2 +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectClock=yes +ProtectHostname=yes +ProtectProc=invisible +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target diff --git a/manifest.json b/manifest.json index 62ebc25..fba8d91 100644 --- a/manifest.json +++ b/manifest.json @@ -10,7 +10,7 @@ "url": "http://ihatemoney.org/", "upstream": { "license": "MIT", - "website": "https://github.com/spiral-project/ihatemoney", + "website": "http://ihatemoney.org/", "admindoc": "https://ihatemoney.readthedocs.org/", "code": "https://github.com/spiral-project/ihatemoney", "demo": "https://ihatemoney.org/demo/" @@ -22,7 +22,7 @@ "url": "https://jocelyn.delalande.fr" }, "requirements": { - "yunohost": ">= 4.3.0" + "yunohost": ">= 11.0.9" }, "multi_instance": true, "services": [ From e9613d6041e47d45d2e722cec105c6ddf0275443 Mon Sep 17 00:00:00 2001 From: yunohost-bot Date: Fri, 13 Jan 2023 19:30:10 +0000 Subject: [PATCH 2/5] Auto-update README --- README.md | 2 +- README_fr.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index d54ad94..de6621c 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ I hate money is a web application made to ease shared budget management. It keep ## Documentation and resources -* Official app website: +* Official app website: * Official admin documentation: * Upstream app code repository: * YunoHost documentation for this app: diff --git a/README_fr.md b/README_fr.md index a4e0b3b..e26d7f9 100644 --- a/README_fr.md +++ b/README_fr.md @@ -44,7 +44,7 @@ I hate money est une application web conçue pour faciliter la gestion partagée ## Documentations et ressources -* Site officiel de l'app : +* Site officiel de l'app : * Documentation officielle de l'admin : * Dépôt de code officiel de l'app : * Documentation YunoHost pour cette app : From 455e3b72efe89af36cb98fe92127762979586466 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89ric=20Gaspar?= <46165813+ericgaspar@users.noreply.github.com> Date: Fri, 13 Jan 2023 20:30:21 +0100 Subject: [PATCH 3/5] Update manifest.json --- manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifest.json b/manifest.json index fba8d91..1e13944 100644 --- a/manifest.json +++ b/manifest.json @@ -6,7 +6,7 @@ "en": "Simple app to manage your collective expenses", "fr": "Gérez simplement vos dépenses collectives" }, - "version": "5.2.0~ynh1", + "version": "5.2.0~ynh2", "url": "http://ihatemoney.org/", "upstream": { "license": "MIT", From 19877bef222bec6e08d2aa3951aed9b6363bacb2 Mon Sep 17 00:00:00 2001 From: yunohost-bot Date: Fri, 13 Jan 2023 19:30:36 +0000 Subject: [PATCH 4/5] Auto-update README --- README.md | 2 +- README_fr.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index de6621c..a769bb2 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/in I hate money is a web application made to ease shared budget management. It keeps track of who bought what, when, and for whom; and helps to settle the bills. -**Shipped version:** 5.2.0~ynh1 +**Shipped version:** 5.2.0~ynh2 **Demo:** https://ihatemoney.org/demo/ diff --git a/README_fr.md b/README_fr.md index e26d7f9..45aa7bb 100644 --- a/README_fr.md +++ b/README_fr.md @@ -18,7 +18,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour I hate money est une application web conçue pour faciliter la gestion partagée du budget. Elle permet de savoir qui a acheté quoi, quand et pour qui, et aide à régler les factures. -**Version incluse :** 5.2.0~ynh1 +**Version incluse :** 5.2.0~ynh2 **Démo :** https://ihatemoney.org/demo/ From 123b1042cae61bdbaf6ec50d7d480438b7e1e0b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89ric=20Gaspar?= <46165813+ericgaspar@users.noreply.github.com> Date: Fri, 13 Jan 2023 21:19:16 +0100 Subject: [PATCH 5/5] Update systemd.service --- conf/systemd.service | 34 ---------------------------------- 1 file changed, 34 deletions(-) diff --git a/conf/systemd.service b/conf/systemd.service index 76a2c0c..5803179 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -11,39 +11,5 @@ ExecStart=__FINALPATH__/venv/bin/gunicorn -c __FINALPATH__/gunicorn.conf.py ihat Restart=always RestartSec=2 -# Sandboxing options to harden security -# Depending on specificities of your service/app, you may need to tweak these -# .. but this should be a good baseline -# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -NoNewPrivileges=yes -PrivateTmp=yes -PrivateDevices=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -DevicePolicy=closed -ProtectClock=yes -ProtectHostname=yes -ProtectProc=invisible -ProtectSystem=full -ProtectControlGroups=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -LockPersonality=yes -SystemCallArchitectures=native -SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged - -# Denying access to capabilities that should not be relevant for webapps -# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html -CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD -CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE -CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT -CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK -CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM -CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG -CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE -CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW -CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG - [Install] WantedBy=multi-user.target