From c93251e463c4390a5c2f83bdb75c5d1ab28b224b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?E=CC=81ric=20Gaspar?= <46165813+ericgaspar@users.noreply.github.com> Date: Thu, 13 Apr 2023 09:17:12 +0200 Subject: [PATCH] fix --- conf/systemd.service | 34 ++++++++++++++++++++++++++++++++++ doc/screenshots/screeshot.png | Bin 903783 -> 503937 bytes 2 files changed, 34 insertions(+) diff --git a/conf/systemd.service b/conf/systemd.service index 5876168..75a5658 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -10,5 +10,39 @@ WorkingDirectory=__INSTALL_DIR__/ ExecStart=__INSTALL_DIR__/librarian LimitNOFILE=65536 +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectClock=yes +ProtectHostname=yes +ProtectProc=invisible +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallArchitectures=native +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target diff --git a/doc/screenshots/screeshot.png b/doc/screenshots/screeshot.png index c62d6ab63d6b5cc7dd4dfcaef2462eb0747626d0..c8a344abc8b0ecd0102e1739c1f2ebca1cd15ad3 100644 GIT binary patch literal 503937 zcmc$_byS?umOWSy2qZwTU;%;#cZVP$Sa1Tt-5r9vyE_DT2*KSc+}+*X9SWU~y!ZNb zPj}D!^IJ2l6&6)jzH`snXP
+E_i6*ozrC0
zB@hUv-S~%+t&*e!m#(EbowlB(jy|2E`A=XR1mfm%{Hd*Ls&7lEqi<+z!9#q~2qq>p
z*5e^oWR+x){3)PsWc 1YNaBE5p4h
z6970EY!Mnp71ZBD M}iqoh(rr~1ZO@KuOy+mf_b26sLT~H+Uq)r72XkA-q
zzoW-@3mJXoiTmWqQ^YHOtpKna RhxK0nCZh%AOJc@@6$91d(;bATS3aC5eDm*P`Ld>KP==iOEPUL?Ie4
zEx-UcpzR4CAVLj{;X}52+w`f6uG9UvpJX!_@lm_OL^JZJvL9hc3J!~=D&+`)U2Nsv
z+4hZ#?SqXy80uN7J%clhW1hzpnB^)h#a>V`OHk
z1V_pXeisZ(EDRh>8
!s7GLr0N+*s$uwLdW>N*=l(nwFy
9vUVJiXWS?=#Ps&}TZs10@|
zWO8@^{vIGVvTtCBHa6GJ!`(ftm>^9QBiTR&1EO2gHNAG!xpV6YPP){92>dD`#Z4=E
zf>1Nib>*L%-=df0yAk(B+(G&>xM#PGc4AE3|Fl}L=45dlBY%O6>D;xh@I+XjKcHU3
zviqK2Y+qs?Hpnxj8h=z&ZXGbBid@H|hN)aA%)g1|qqj@-%4avZ(YNP$Qz?gPH9{Si
zKAf-lW7sgFP5-sNy;m+#M?6w%B4ax#G_GFkoGq90<`{!C4m9=|IEnlAmW{@HvrVX#
zSC~N{m4^4G%H
zh~#7&=SiF+Tx8PiuZ7Ldu24|5%dq+2DkMNSD8Bs;5n&)i64JgT6Jz?T;skO3W_4T&LBhC2))gn|a4E{FhAyo!O8I1x+%ZR9NoRRb^r
z161HThzV@q41|lp|FYY-zA_*`0WQw=)31^I|ErV^MJd==f@LBOkc1FOmN~IO$3hSq
z*a%|$yJaC+
z7a6IjVCm*fH=R*h=6*8Q(As1I#FUG0Inp8hHnsxnd+gJ0Bbv~Wk$Wj(3l(*%I^nqK
z`fANfq^D3RaFv|