From 22abbe338ad745de292d0b8de80dcab3f9f7079b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nathana=C3=ABl=20Hannebert?= Date: Thu, 11 Apr 2024 21:26:55 +0200 Subject: [PATCH] chg: small fix and rollback systemd.service hardening as the app is not working with this change, we should postpone this improvment to a dedicated PR --- conf/systemd.service | 36 +----------------------------------- 1 file changed, 1 insertion(+), 35 deletions(-) diff --git a/conf/systemd.service b/conf/systemd.service index 805b2d8..2f37346 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -7,41 +7,7 @@ Type=simple User=__APP__ Group=__APP__ WorkingDirectory=__INSTALL_DIR__/ -ExecStart=__INSTALL_DIR__/mautrix-signal - -### Depending on specificities of your service/app, you may need to tweak these -### .. but this should be a good baseline -# Sandboxing options to harden security -# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -NoNewPrivileges=yes -PrivateTmp=yes -PrivateDevices=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -DevicePolicy=closed -ProtectClock=yes -ProtectHostname=yes -ProtectProc=invisible -ProtectSystem=full -ProtectControlGroups=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -LockPersonality=yes -SystemCallArchitectures=native -SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged - -# Denying access to capabilities that should not be relevant for webapps -# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html -CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD -CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE -CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT -CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK -CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM -CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG -CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE -CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW -CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG +ExecStart=__INSTALL_DIR__/mautrix-signal -c=__INSTALL_DIR__/config.yaml [Install] WantedBy=multi-user.target