From f953bc81c58088397922b57127c767ae06a7d5dd Mon Sep 17 00:00:00 2001
From: tituspijean <tituspijean@outlook.com>
Date: Sun, 3 Oct 2021 14:21:14 +0200
Subject: [PATCH] Harden security of systemd service

---
 conf/systemd.service | 28 ++++++++++++++++++++++++++++
 manifest.json        |  2 +-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/conf/systemd.service b/conf/systemd.service
index 8d43466..cb7d3f7 100644
--- a/conf/systemd.service
+++ b/conf/systemd.service
@@ -12,5 +12,33 @@ ExecStart=__YNH_NODE__ red.js -p __PORT__ -u __FINALPATH__/data
 StandardOutput=append:/var/log/__APP__/__APP__.log
 StandardError=inherit
 
+# Sandboxing options to harden security
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
+
 [Install]
 WantedBy=multi-user.target
diff --git a/manifest.json b/manifest.json
index 069721f..132dcc9 100644
--- a/manifest.json
+++ b/manifest.json
@@ -6,7 +6,7 @@
         "en": "Flow-based programming for the Internet of Things",
         "fr": "Programmation par flux de données pour l'Internet des objets"
     },
-    "version": "2.0.6~ynh2",
+    "version": "2.0.6~ynh1",
     "url": "https://nodered.org",
     "upstream": {
         "license": "Apache-2.0",