Testing (#57)

* Add sanboxing * Add purge data directory from cli
2024-09-03 20:26:18 +02:00 · 2021-08-22 13:54:57 +02:00 · 2021-08-22 13:54:57 +02:00 · 0c12e7d1b8
commit 0c12e7d1b8
parent 78f31fc31a
9 changed files with 79 additions and 37 deletions
--- a/README.md
+++ b/README.md
@ -17,7 +17,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/in

 Self-hosted remote torrent client

-**Shipped version:** 1.3.6~ynh1
+**Shipped version:** 1.3.6~ynh2



--- a/README_fr.md
+++ b/README_fr.md
@ -13,7 +13,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour

 Client torrent distant auto-hébergé

-**Version incluse :** 1.3.6~ynh1
+**Version incluse :** 1.3.6~ynh2



--- a/conf/systemd.service
+++ b/conf/systemd.service
@ -12,5 +12,35 @@ ExecStart=__FINALPATH__/__APP__ -c __FINALPATH__/config.yml --host 127.0.0.1
 Restart=always
 RestartSec=3

+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these 
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
+
 [Install]
 WantedBy=multi-user.target
--- a/manifest.json
+++ b/manifest.json
@ -6,7 +6,7 @@
        "en": "Self-hosted remote torrent client",
        "fr": "Client torrent distant auto-hébergé"
    },
-    "version": "1.3.6~ynh1",
+    "version": "1.3.6~ynh2",
    "url": "https://github.com/boypt/simple-torrent",
    "upstream": {
        "license": "AGPL-3.0-only",
@ -19,7 +19,7 @@
        "name": "eric_G"
    },
    "requirements": {
-        "yunohost": ">= 4.2.4"
+        "yunohost": ">= 4.2.8"
    },
    "multi_instance": true,
    "services": [
--- a/scripts/backup
+++ b/scripts/backup
@ -25,6 +25,7 @@ app=$YNH_APP_INSTANCE_NAME

 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
 domain=$(ynh_app_setting_get --app=$app --key=domain)
+datadir=$(ynh_app_setting_get --app=$app --key=datadir)

 #=================================================
 # DECLARE DATA AND CONF FILES TO BACKUP
@ -41,7 +42,7 @@ ynh_backup --src_path="$final_path"
 # BACKUP DATA
 #=================================================

-ynh_backup --src_path="/home/yunohost.app/$app" --is_big
+ynh_backup --src_path="$datadir" --is_big

 #=================================================
 # BACKUP THE NGINX CONFIGURATION
--- a/scripts/install
+++ b/scripts/install
@ -107,13 +107,19 @@ ynh_script_progression --message="Configuring NGINX web server..." --weight=3
 ynh_add_nginx_config

 #=================================================
-# CREATE DIRECTORIES
+# CREATE DATA DIRECTORY
 #=================================================
+ynh_script_progression --message="Creating a data directory..." --weight=1
+
+datadir=/home/yunohost.app/$app
+ynh_app_setting_set --app=$app --key=datadir --value=$datadir
+
+mkdir -p $datadir/{torrents,downloads}

-mkdir -p /home/yunohost.app/$app/{torrents,downloads}
 # Set permissions to app files
-chown -R $app:www-data /home/yunohost.app/$app
-chmod 755 /home/yunohost.app/$app/{torrents,downloads}
+chmod 755 $datadir/{torrents,downloads}
+chmod -R o-rwx $datadir
+chown -R $app:www-data $datadir

 #=================================================
 # MODIFY A CONFIG FILE
--- a/scripts/remove
+++ b/scripts/remove
@ -20,6 +20,7 @@ domain=$(ynh_app_setting_get --app=$app --key=domain)
 port=$(ynh_app_setting_get --app=$app --key=port)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
 peer_port=$(ynh_app_setting_get --app=$app --key=peer_port)
+datadir=$(ynh_app_setting_get --app=$app --key=datadir)

 #=================================================
 # STANDARD REMOVE
@ -50,6 +51,17 @@ ynh_script_progression --message="Removing $app main directory..." --weight=6
 # Remove the app directory securely
 ynh_secure_remove --file="$final_path"

+#=================================================
+# REMOVE DATA DIR
+#=================================================
+
+# Remove the app data directory with the command `yunohost app remove --purge`
+if [ "$YNH_APP_PURGE" == true ]
+then
+  ynh_script_progression --message="Removing $app data directory..." --weight=2
+  ynh_secure_remove --file="$datadir"
+fi
+
 #=================================================
 # REMOVE NGINX CONFIGURATION
 #=================================================
--- a/scripts/restore
+++ b/scripts/restore
@ -27,6 +27,7 @@ domain=$(ynh_app_setting_get --app=$app --key=domain)
 path_url=$(ynh_app_setting_get --app=$app --key=path)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
 peer_port=$(ynh_app_setting_get --app=$app --key=peer_port)
+datadir=$(ynh_app_setting_get --app=$app --key=datadir)

 #=================================================
 # CHECK IF THE APP CAN BE RESTORED
@ -52,7 +53,6 @@ ynh_restore_file --origin_path="/etc/nginx/conf.d/$domain.d/$app.conf"
 #=================================================
 ynh_script_progression --message="Configuring firewall..." --weight=3

-#ynh_exec_warn_less yunohost firewall allow --no-upnp TCP $port
 ynh_exec_warn_less yunohost firewall allow Both $peer_port

 #=================================================
@ -80,10 +80,13 @@ chmod +x $final_path/$app
 #=================================================
 ynh_script_progression --message="Restoring $app data..." --weight=10

-ynh_restore_file --origin_path="/home/yunohost.app/$app" --not_mandatory
+ynh_restore_file --origin_path="$datadir" --not_mandatory

-chown -R $app:www-data /home/yunohost.app/$app
-chmod 755 /home/yunohost.app/$app/{torrents,downloads}
+mkdir -p $datadir/{torrents,downloads}
+
+chmod 755 $datadir/{torrents,downloads}
+chmod -R o-rwx $datadir
+chown -R $app:www-data $datadir

 #=================================================
 # RESTORE SYSTEMD
--- a/scripts/upgrade
+++ b/scripts/upgrade
@ -26,10 +26,23 @@ architecture=$(ynh_detect_arch)
 #=================================================
 # CHECK VERSION
 #=================================================
-ynh_script_progression --message="Checking version..."

 upgrade_type=$(ynh_check_app_version_changed)

+#=================================================
+# BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
+#=================================================
+ynh_script_progression --message="Backing up $app before upgrading (may take a while)..." --weight=4
+
+# Backup the current version of the app
+ynh_backup_before_upgrade
+ynh_clean_setup () {
+	# restore it if the upgrade fails
+	ynh_restore_upgradebackup
+}
+# Exit if an error occurs during the execution of the script
+ynh_abort_if_errors
+
 #=================================================
 # ENSURE DOWNWARD COMPATIBILITY
 #=================================================
@ -48,20 +61,6 @@ if ynh_legacy_permissions_exists; then
 	ynh_app_setting_delete --app=$app --key=is_public
 fi

-#=================================================
-# BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
-#=================================================
-ynh_script_progression --message="Backing up $app before upgrading (may take a while)..." --weight=4
-
-# Backup the current version of the app
-ynh_backup_before_upgrade
-ynh_clean_setup () {
-	# restore it if the upgrade fails
-	ynh_restore_upgradebackup
-}
-# Exit if an error occurs during the execution of the script
-ynh_abort_if_errors
-
 #=================================================
 # STANDARD UPGRADE STEPS
 #=================================================
@ -119,15 +118,6 @@ ynh_script_progression --message="Modifying a config file..." --weight=1

 ynh_add_config --template="../conf/config.default.yml" --destination="$final_path/config.yml"

-#=================================================
-# CREATE DIRECTORIES
-#=================================================
-
-mkdir -p /home/yunohost.app/$app/{torrents,downloads}
-
-chown -R $app:www-data /home/yunohost.app/$app
-chmod 755 /home/yunohost.app/$app/{torrents,downloads}
-
 #=================================================
 # SETUP SYSTEMD
 #=================================================