From adb5c804113ec8c6c1bb9bba6b38daa069c796c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89ric=20Gaspar?=
 <46165813+ericgaspar@users.noreply.github.com>
Date: Thu, 23 Jun 2022 09:47:27 +0200
Subject: [PATCH] Cleaning up

---
 conf/systemd.service | 30 ++++++++++++++++++++++++++++++
 scripts/restore      |  3 ++-
 scripts/upgrade      |  1 -
 3 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/conf/systemd.service b/conf/systemd.service
index ae18c37..b6cc2dd 100644
--- a/conf/systemd.service
+++ b/conf/systemd.service
@@ -12,5 +12,35 @@ ExecStart=__FINALPATH__/shiori serve --port __PORT__ --webroot __PATH__
 Restart=always
 Environment="SHIORI_DIR=__DATADIR__"
 
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these 
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
+
 [Install]
 WantedBy=multi-user.target
diff --git a/scripts/restore b/scripts/restore
index 61c4223..9c610cb 100755
--- a/scripts/restore
+++ b/scripts/restore
@@ -34,7 +34,8 @@ datadir=$(ynh_app_setting_get --app=$app --key=datadir)
 #=================================================
 ynh_script_progression --message="Validating restoration parameters..." --weight=1
 
-test ! -d $final_path || ynh_die --message="There is already a directory: $final_path"
+test ! -d $final_path
+	|| ynh_die --message="There is already a directory: $final_path"
 
 #=================================================
 # STANDARD RESTORATION STEPS
diff --git a/scripts/upgrade b/scripts/upgrade
index 4953279..d1a336b 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -21,7 +21,6 @@ path_url=$(ynh_app_setting_get --app=$app --key=path)
 port=$(ynh_app_setting_get --app=$app --key=port)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
 datadir=$(ynh_app_setting_get --app=$app --key=datadir)
-architecture=$YNH_ARCH
 
 #=================================================
 # CHECK VERSION