From cc5c576df9c599c55396ff7780d91992d63c264b Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Fri, 20 Aug 2021 20:13:45 +0200 Subject: [PATCH 1/3] Update systemd.service --- conf/systemd.service | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/conf/systemd.service b/conf/systemd.service index 11c39ae..df7f518 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -11,5 +11,35 @@ Environment="PATH=__ENV_PATH__" Environment=NODE_ENV=production ExecStart=/usr/bin/websockify --web=__FINALPATH__/dist/ --ssl-target 127.0.0.1:__PORT__ 127.0.0.1:64738 +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target From ed6f3c1ea9968ab94f13730e5962ba82b2e658c9 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Sat, 21 Aug 2021 08:21:23 +0200 Subject: [PATCH 2/3] Update manifest.json --- manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifest.json b/manifest.json index b7ee1ad..f257207 100644 --- a/manifest.json +++ b/manifest.json @@ -6,7 +6,7 @@ "en": "Web interface for voice chat software (VoIP)", "fr": "Interface web interface pour voix sur IP (VoIP)" }, - "version": "1.3.0~ynh2", + "version": "1.3.0~ynh3", "url": "https://mumble.info", "upstream": { "license": "BSD-3-Clause", From 2ec087c6ff0e6225cd71226e04786e743d74cf0f Mon Sep 17 00:00:00 2001 From: Yunohost-Bot <> Date: Sat, 21 Aug 2021 06:21:27 +0000 Subject: [PATCH 3/3] Auto-update README --- README.md | 2 +- README_fr.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index fb5f72b..8282a06 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/in Web interface for voice chat software (VoIP) -**Shipped version:** 1.3.0~ynh2 +**Shipped version:** 1.3.0~ynh3 **Demo:** https://web.mumble.framatalk.org/ diff --git a/README_fr.md b/README_fr.md index 3bda1bb..d5b7bc6 100644 --- a/README_fr.md +++ b/README_fr.md @@ -13,7 +13,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour Interface web interface pour voix sur IP (VoIP) -**Version incluse :** 1.3.0~ynh2 +**Version incluse :** 1.3.0~ynh3 **Démo :** https://web.mumble.framatalk.org/