From a4d2695d22f8966add12974aab21f99750fdca5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nathana=C3=ABl=20Hannebert?=
 <nathanael.hannebert@cockpitio.com>
Date: Wed, 10 Apr 2024 08:02:48 +0200
Subject: [PATCH] chg: fix linter warning : remove signald service, harden
 systemd.service file, listen only on localhost in config.yaml

---
 conf/config.yaml     |  2 +-
 conf/signald.service | 21 ---------------------
 conf/systemd.service | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 22 deletions(-)
 delete mode 100644 conf/signald.service

diff --git a/conf/config.yaml b/conf/config.yaml
index cbe23d0..e7a9e65 100644
--- a/conf/config.yaml
+++ b/conf/config.yaml
@@ -31,7 +31,7 @@ appservice:
     address: http://localhost:__PORT__
 
     # The hostname and port where this appservice should listen.
-    hostname: 0.0.0.0
+    hostname: localhost
     port: __PORT__
 
     # Database config.
diff --git a/conf/signald.service b/conf/signald.service
deleted file mode 100644
index f53053b..0000000
--- a/conf/signald.service
+++ /dev/null
@@ -1,21 +0,0 @@
-[Unit]
-Description=A daemon for interacting with the Signal Private Messenger
-Wants=network.target
-After=network.target
-
-[Service]
-Type=simple
-RuntimeDirectory=signald
-RuntimeDirectoryMode=0770
-User=__SIGNALD_USER__
-Group=__SIGNALD_USER__
-#ExecStart=/usr/bin/signald -d /var/lib/signald
-ExecStart=__SIGNALD_PATH__/build/install/signald/bin/signald -d /var/lib/signald
-EnvironmentFile=-/etc/default/signald
-Restart=on-failure
-UMask=0007
-# JVM always exits with 143 in reaction to SIGTERM signal
-SuccessExitStatus=143
-
-[Install]
-WantedBy=default.target
diff --git a/conf/systemd.service b/conf/systemd.service
index b0c69e3..805b2d8 100644
--- a/conf/systemd.service
+++ b/conf/systemd.service
@@ -9,5 +9,39 @@ Group=__APP__
 WorkingDirectory=__INSTALL_DIR__/
 ExecStart=__INSTALL_DIR__/mautrix-signal
 
+### Depending on specificities of your service/app, you may need to tweak these
+### .. but this should be a good baseline
+# Sandboxing options to harden security
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
+
 [Install]
 WantedBy=multi-user.target