From ae73a9aab338cba9eb0e275f1270d2ee25947c93 Mon Sep 17 00:00:00 2001 From: Dante Date: Sun, 19 Jun 2022 17:48:17 +0100 Subject: [PATCH 1/5] Add systemd recommended hardening --- conf/systemd.service | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/conf/systemd.service b/conf/systemd.service index b3aad5a..1c4fd5e 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -11,5 +11,27 @@ ExecStart=/opt/yunohost/__APP__/mautrix-whatsapp -c=/opt/yunohost/__APP__/config Restart=always RestartSec=3 +# Optional hardening to improve security +ReadWritePaths=/opt/mautrix-whatsapp +NoNewPrivileges=yes +MemoryDenyWriteExecute=true +PrivateDevices=yes +PrivateTmp=yes +ProtectHome=yes +ProtectSystem=strict +ProtectControlGroups=true +RestrictSUIDSGID=true +RestrictRealtime=true +LockPersonality=true +ProtectKernelLogs=true +ProtectKernelTunables=true +ProtectHostname=true +ProtectKernelModules=true +PrivateUsers=true +ProtectClock=true +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service + [Install] WantedBy=multi-user.target From 5c49b66ac3cfa4cd8ded5a7bf06f6b706e891d9f Mon Sep 17 00:00:00 2001 From: Dante Date: Mon, 20 Jun 2022 12:35:18 +0100 Subject: [PATCH 2/5] Systemd hardening add required home dir --- conf/systemd.service | 2 +- scripts/install | 5 +++-- scripts/restore | 5 +++-- scripts/upgrade | 5 +++-- 4 files changed, 10 insertions(+), 7 deletions(-) diff --git a/conf/systemd.service b/conf/systemd.service index 1c4fd5e..90371cb 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -12,7 +12,7 @@ Restart=always RestartSec=3 # Optional hardening to improve security -ReadWritePaths=/opt/mautrix-whatsapp +ReadWritePaths=/opt/yunohost/__APP__ NoNewPrivileges=yes MemoryDenyWriteExecute=true PrivateDevices=yes diff --git a/scripts/install b/scripts/install index ae5b401..b2320ee 100755 --- a/scripts/install +++ b/scripts/install @@ -107,8 +107,9 @@ ynh_exec_warn_less ynh_install_app_dependencies $pkg_dependencies #================================================= ynh_script_progression --message="Configuring system user..." --weight=1 -# Create a system user -ynh_system_user_create --username=$app +# Create a system user and set home dir to /opt/yunohost/$app so systemd hardening works +# See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service +ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app #================================================= # CREATE A POSTGRESQL DATABASE diff --git a/scripts/restore b/scripts/restore index 4b78749..a47af8c 100755 --- a/scripts/restore +++ b/scripts/restore @@ -66,8 +66,9 @@ test ! -d $final_path || ynh_die --message="There is already a directory: $final #================================================= ynh_script_progression --message="Recreating the dedicated system user..." --weight=1 -# Create the dedicated user (if not existing) -ynh_system_user_create --username=$app +# Create a dedicated user (if not existing) and set home dir to /opt/yunohost/$app so systemd hardening works +# See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service +ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app #================================================= # RESTORE THE APP MAIN DIR diff --git a/scripts/upgrade b/scripts/upgrade index 11ff7f4..b685170 100755 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -134,8 +134,9 @@ ynh_exec_warn_less ynh_install_app_dependencies $pkg_dependencies #================================================= ynh_script_progression --message="Making sure dedicated system user exists..." --weight=8 -# Create a dedicated user (if not existing) -ynh_system_user_create --username=$app +# Create a dedicated user (if not existing) and set home dir to /opt/yunohost/$app so systemd hardening works +# See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service +ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app #================================================= # DOWNLOAD, CHECK AND UNPACK SOURCE From 2c5ad939e0e3be6e0b9ba175a9290b3c082ff279 Mon Sep 17 00:00:00 2001 From: Dante Date: Wed, 6 Jul 2022 15:57:14 +0100 Subject: [PATCH 3/5] Fix upgrade script --- scripts/upgrade | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/upgrade b/scripts/upgrade index b685170..ede6e19 100755 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -136,7 +136,11 @@ ynh_script_progression --message="Making sure dedicated system user exists..." - # Create a dedicated user (if not existing) and set home dir to /opt/yunohost/$app so systemd hardening works # See more: https://docs.mau.fi/bridges/go/setup.html?bridge=whatsapp#systemd-service -ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app +if ynh_system_user_exists -u "$app"; then + usermod --home /opt/yunohost/$app $app +else + ynh_system_user_create --username=$app --home_dir=/opt/yunohost/$app +fi #================================================= # DOWNLOAD, CHECK AND UNPACK SOURCE From 6f6b84638dc2e6e50505eb65310fefb4f2ee06e1 Mon Sep 17 00:00:00 2001 From: Dante Date: Wed, 20 Jul 2022 17:52:29 +0100 Subject: [PATCH 4/5] Bump yuno version --- README.md | 2 +- README_fr.md | 2 +- manifest.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 45eb4c8..440c74d 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ Therefore, [Synapse for YunoHost](https://github.com/YunoHost-Apps/synapse_ynh) ** Attention: always backup and restore the Yunohost matrix_synapse et mautrix_whatsapp apps together!** -**Shipped version:** 0.6.0~ynh1 +**Shipped version:** 0.6.0~ynh2 ## Disclaimers / important information ### List of known public services diff --git a/README_fr.md b/README_fr.md index 86224b7..701ddab 100644 --- a/README_fr.md +++ b/README_fr.md @@ -24,7 +24,7 @@ C'est pourquoi [Synapse for YunoHost](https://github.com/YunoHost-Apps/synapse_y ** Attention : sauvegardez et restaurez toujours les deux applications Yunohost matrix_synapse et mautrix_whatsapp en même temps!** -**Version incluse :** 0.6.0~ynh1 +**Version incluse :** 0.6.0~ynh2 ## Avertissements / informations importantes ### Liste de passerelles publiques diff --git a/manifest.json b/manifest.json index 8c165b1..8470572 100644 --- a/manifest.json +++ b/manifest.json @@ -6,7 +6,7 @@ "en": "Matrix / Synapse puppeting bridge for WhatsApp", "fr": "Passerelle Matrix / Synapse pour WhatsApp" }, - "version": "0.6.0~ynh1", + "version": "0.6.0~ynh2", "url": "https://github.com/mautrix/whatsapp", "upstream": { "license": "AGPL-3.0-or-later", From c9c7c470118dc78096def5cdb0a3a890e9e079d5 Mon Sep 17 00:00:00 2001 From: Dante Date: Wed, 20 Jul 2022 18:32:18 +0100 Subject: [PATCH 5/5] Fix linter issue on remove script --- scripts/remove | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/remove b/scripts/remove index d97608d..86bceee 100755 --- a/scripts/remove +++ b/scripts/remove @@ -120,4 +120,4 @@ ynh_system_user_delete --username=$app # END OF SCRIPT #================================================= -ynh_script_progression --message="Removal of $app completed" --time --last +ynh_script_progression --message="Removal of $app completed" --last