Merge pull request #127 from YunoHost-Apps/Harden-systemd

Harden systemd

README.md

@@ -20,7 +20,7 @@ Rocket.Chat is an open-source fully customizable communications platform develop
 ### Features
 
 - End to End Encryption
-- LDAP/Active Directory
+- LDAP/Active Directory (manual setup)
 - Multifactor Authentication
 - Customizable User Permission
 - Mobile Apps for [iOS](https://apps.apple.com/app/rocket-chat/id1148741252) and [Android](https://play.google.com/store/apps/details?id=chat.rocket.android)

README_fr.md

@@ -20,7 +20,7 @@ Rocket.Chat est une plate-forme de communication open source entièrement person
 ### Fonctionnalités
 
 - Chiffrement de bout en bout
-- LDAP
+- LDAP (configuration manuelle)
 - Authentification multifacteur
 - Autorisation utilisateur personnalisable
 - Applications mobiles pour [iOS](https://apps.apple.com/app/rocket-chat/id1148741252) et [Android](https://play.google.com/store/apps/details?id=chat.rocket.android)

conf/systemd.service

@@ -20,5 +20,35 @@ Environment=ADMIN_PASS=__PASSWORD__
 Environment=ADMIN_EMAIL=__EMAIL__
 Environment=OVERWRITE_SETTING_Show_Setup_Wizard=completed
 
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these 
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
+
 [Install]
 WantedBy=multi-user.target

doc/DESCRIPTION.md

@@ -3,7 +3,7 @@ Rocket.Chat is an open-source fully customizable communications platform develop
 ### Features
 
 - End to End Encryption
-- LDAP/Active Directory
+- LDAP/Active Directory (manual setup)
 - Multifactor Authentication
 - Customizable User Permission
 - Mobile Apps for [iOS](https://apps.apple.com/app/rocket-chat/id1148741252) and [Android](https://play.google.com/store/apps/details?id=chat.rocket.android)

doc/DESCRIPTION_fr.md

@@ -3,7 +3,7 @@ Rocket.Chat est une plate-forme de communication open source entièrement person
 ### Fonctionnalités
 
 - Chiffrement de bout en bout
-- LDAP
+- LDAP (configuration manuelle)
 - Authentification multifacteur
 - Autorisation utilisateur personnalisable
 - Applications mobiles pour [iOS](https://apps.apple.com/app/rocket-chat/id1148741252) et [Android](https://play.google.com/store/apps/details?id=chat.rocket.android)

scripts/install

@@ -92,7 +92,7 @@ ynh_system_user_create --username=$app --home_dir="$final_path"
 #=================================================
 # CREATE A MONGODB DATABASE
 #=================================================
-ynh_script_progression --message="Creating a MongoDB database..."
+ynh_script_progression --message="Creating a MongoDB database..." --weight=2
 
 db_name=$(ynh_sanitize_dbid --db_name=$app)
 db_user=$db_name
@@ -168,7 +168,7 @@ ynh_use_logrotate
 #=================================================
 # INTEGRATE SERVICE IN YUNOHOST
 #=================================================
-ynh_script_progression --message="Integrating service in YunoHost..."
+ynh_script_progression --message="Integrating service in YunoHost..." --weight=1
 
 yunohost service add $app --description="Team collaboration communication platform"
 

scripts/remove

@@ -54,7 +54,7 @@ ynh_remove_logrotate
 #=================================================
 # REMOVE THE MONGODB DATABASE
 #=================================================
-ynh_script_progression --message="Removing the MongoDB database..."
+ynh_script_progression --message="Removing the MongoDB database..." --weight=3
 
 ynh_replace_string --match_string="engine: wiredTiger" --replace_string="#  engine:" --target_file=$MONGO_CE_CONFIG
 ynh_replace_string --match_string="replication:" --replace_string="#replication:" --target_file=$MONGO_CE_CONFIG