From f9644cb5bc000374f9b9af77679c060b84241e51 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Sat, 1 Oct 2022 09:03:02 +0200 Subject: [PATCH 1/3] Update systemd.service --- conf/systemd.service | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/conf/systemd.service b/conf/systemd.service index 3ebc0dd..2b14168 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -19,5 +19,35 @@ StandardOutput=syslog StandardError=syslog SyslogIdentifier=__APP__ +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] WantedBy=multi-user.target From ffb6647d56504e0465c026cd3819700406b94551 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Fri, 14 Oct 2022 19:37:17 +0200 Subject: [PATCH 2/3] Update manifest.json --- manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifest.json b/manifest.json index 7262560..33fdeba 100644 --- a/manifest.json +++ b/manifest.json @@ -6,7 +6,7 @@ "en": "Forum software built for the modern web", "fr": "Logiciel de forum conçu pour le Web moderne" }, - "version": "2.5.2~ynh1", + "version": "2.5.7~ynh1", "url": "https://nodebb.org", "upstream": { "license": "GPL-3.0", From fbd6475b8912059305a57e30ec5951fd900fc32e Mon Sep 17 00:00:00 2001 From: yunohost-bot Date: Fri, 14 Oct 2022 17:37:23 +0000 Subject: [PATCH 3/3] Auto-update README --- README.md | 3 +-- README_fr.md | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index fd793a2..2c0c423 100644 --- a/README.md +++ b/README.md @@ -18,8 +18,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/in NodeBB is built using the Node.js server-side Javascript platform, delivering unmatched performance. Building on this high performance platform means fast and dependable performance that will support even the biggest and most active community. -**Shipped version:** 2.5.2~ynh1 - +**Shipped version:** 2.5.7~ynh1 **Demo:** https://try.nodebb.org diff --git a/README_fr.md b/README_fr.md index a098f36..ba6963a 100644 --- a/README_fr.md +++ b/README_fr.md @@ -18,8 +18,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour NodeBB is built using the Node.js server-side Javascript platform, delivering unmatched performance. Building on this high performance platform means fast and dependable performance that will support even the biggest and most active community. -**Version incluse :** 2.5.2~ynh1 - +**Version incluse :** 2.5.7~ynh1 **Démo :** https://try.nodebb.org