From 3afa0c38a1103f1f9404a0883c9f4a2e93c2abf7 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Wed, 8 Sep 2021 10:37:43 +0200 Subject: [PATCH 1/3] Update systemd.service --- conf/systemd.service | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/conf/systemd.service b/conf/systemd.service index ad69553..a972d44 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -12,5 +12,35 @@ ExecStart=__FINALPATH__/matterbridge -conf __FINALPATH__/matterbridge.toml RestartSec=30 Restart=always +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target From 23e8ec55f1b8ca354a292fa79af5e26130c77f2e Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Wed, 8 Sep 2021 22:30:08 +0200 Subject: [PATCH 2/3] Update manifest.json --- manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifest.json b/manifest.json index 096fc66..f2e4318 100644 --- a/manifest.json +++ b/manifest.json @@ -6,7 +6,7 @@ "en": "Multi-protocols bridge for online communications", "fr": "Connecteur entre une série de protocoles de discussion" }, - "version": "1.22.3~ynh1", + "version": "1.22.3~ynh2", "url": "https://github.com/42wim/matterbridge", "upstream": { "license": "Apache-2.0", From 082731c73463c2ddfb79d0463149c5c2cb44b974 Mon Sep 17 00:00:00 2001 From: Yunohost-Bot <> Date: Wed, 8 Sep 2021 20:30:14 +0000 Subject: [PATCH 3/3] Auto-update README --- README.md | 2 +- README_fr.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ce996f6..cfc00fa 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/in Multi-protocols bridge for online communications -**Shipped version:** 1.22.3~ynh1 +**Shipped version:** 1.22.3~ynh2 diff --git a/README_fr.md b/README_fr.md index 3f820b3..e35b31b 100644 --- a/README_fr.md +++ b/README_fr.md @@ -13,7 +13,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour Connecteur entre une série de protocoles de discussion -**Version incluse :** 1.22.3~ynh1 +**Version incluse :** 1.22.3~ynh2