YunoHost-Apps/mautrix_whatsapp_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/mautrix_whatsapp_ynh.git synced 2024-09-03 19:46:01 +02:00
Code Issues Activity Actions

Merge pull request #58 from YunoHost-Apps/add-systemd-hardening

Browse source 
Add systemd recommended hardening
This commit is contained in:
Dante 2022-07-28 21:52:39 +02:00 • committed by GitHub
commit 6453e31030
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 39 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -24,7 +24,7 @@ Therefore, [Synapse for YunoHost](https://github.com/YunoHost-Apps/synapse_ynh)
** Attention: always backup and restore the Yunohost matrix_synapse et mautrix_whatsapp apps together!** ** Attention: always backup and restore the Yunohost matrix_synapse et mautrix_whatsapp apps together!**
**Shipped version:** 0.6.0~ynh1 **Shipped version:** 0.6.0~ynh2
## Disclaimers / important information ## Disclaimers / important information
### List of known public services ### List of known public services

2
README_fr.md
View file

@ -24,7 +24,7 @@ C'est pourquoi [Synapse for YunoHost](https://github.com/YunoHost-Apps/synapse_y
** Attention : sauvegardez et restaurez toujours les deux applications Yunohost matrix_synapse et mautrix_whatsapp en même temps!** ** Attention : sauvegardez et restaurez toujours les deux applications Yunohost matrix_synapse et mautrix_whatsapp en même temps!**
**Version incluse :** 0.6.0~ynh1 **Version incluse :** 0.6.0~ynh2
## Avertissements / informations importantes ## Avertissements / informations importantes
### Liste de passerelles publiques ### Liste de passerelles publiques

22
conf/systemd.service
View file

@ -11,5 +11,27 @@ ExecStart=/opt/yunohost/__APP__/mautrix-whatsapp -c=/opt/yunohost/__APP__/config
Restart=always Restart=always
RestartSec=3 RestartSec=3
# Optional hardening to improve security
ReadWritePaths=/opt/yunohost/__APP__
NoNewPrivileges=yes
MemoryDenyWriteExecute=true
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=strict
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
ProtectKernelLogs=true
ProtectKernelTunables=true
ProtectHostname=true
ProtectKernelModules=true
PrivateUsers=true
ProtectClock=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

2
manifest.json
View file

@ -6,7 +6,7 @@
"en": "Matrix / Synapse puppeting bridge for WhatsApp", "en": "Matrix / Synapse puppeting bridge for WhatsApp",
"fr": "Passerelle Matrix / Synapse pour WhatsApp" "fr": "Passerelle Matrix / Synapse pour WhatsApp"
}, },
"version": "0.6.0~ynh1", "version": "0.6.0~ynh2",
"url": "https://github.com/mautrix/whatsapp", "url": "https://github.com/mautrix/whatsapp",
"upstream": { "upstream": {
"license": "AGPL-3.0-or-later", "license": "AGPL-3.0-or-later",

5
scripts/install
View file

@ -107,8 +107,9 @@ ynh_exec_warn_less ynh_install_app_dependencies $pkg_dependencies
#================================================= #=================================================
ynh_script_progression --message="Configuring system user..." --weight=1 ynh_script_progression --message="Configuring system user..." --weight=1
# Create a system user # Create a system user and set home dir to /opt/yunohost/$app so systemd hardening works
ynh_system_user_create --username=$app # See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service
ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app
#================================================= #=================================================
# CREATE A POSTGRESQL DATABASE # CREATE A POSTGRESQL DATABASE

2
scripts/remove
View file

@ -120,4 +120,4 @@ ynh_system_user_delete --username=$app
# END OF SCRIPT # END OF SCRIPT
#================================================= #=================================================
ynh_script_progression --message="Removal of $app completed" --time --last ynh_script_progression --message="Removal of $app completed" --last

5
scripts/restore
View file

@ -66,8 +66,9 @@ test ! -d $final_path || ynh_die --message="There is already a directory: $final
#================================================= #=================================================
ynh_script_progression --message="Recreating the dedicated system user..." --weight=1 ynh_script_progression --message="Recreating the dedicated system user..." --weight=1
# Create the dedicated user (if not existing) # Create a dedicated user (if not existing) and set home dir to /opt/yunohost/$app so systemd hardening works
ynh_system_user_create --username=$app # See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service
ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app
#================================================= #=================================================
# RESTORE THE APP MAIN DIR # RESTORE THE APP MAIN DIR

9
scripts/upgrade
View file

@ -134,8 +134,13 @@ ynh_exec_warn_less ynh_install_app_dependencies $pkg_dependencies
#================================================= #=================================================
ynh_script_progression --message="Making sure dedicated system user exists..." --weight=8 ynh_script_progression --message="Making sure dedicated system user exists..." --weight=8
# Create a dedicated user (if not existing) # Create a dedicated user (if not existing) and set home dir to /opt/yunohost/$app so systemd hardening works
ynh_system_user_create --username=$app # See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service
if ynh_system_user_exists -u "$app"; then
usermod --home /opt/yunohost/$app $app
else
ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app
fi
#================================================= #=================================================
# DOWNLOAD, CHECK AND UNPACK SOURCE # DOWNLOAD, CHECK AND UNPACK SOURCE