From 674729454fa59c36b1fd38d359db6e8c156cd480 Mon Sep 17 00:00:00 2001 From: Fabian Wilkens Date: Sun, 8 Aug 2021 10:23:58 +0200 Subject: [PATCH] Update: systemd.service security --- conf/systemd.service | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/conf/systemd.service b/conf/systemd.service index 9725efa..1f22676 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -10,9 +10,35 @@ EnvironmentFile=__FINALPATH__/live/.env WorkingDirectory=__FINALPATH__/live/ ExecStart=__RBENV_INSTALL_DIR__/versions/__APP__/bin/bundle exec puma -C config/puma.rb -p __PORT__ -e production StandardOutput=append:/var/log/__APP__/snweb.log -StandardError=append:/var/log/__APP__/snweb.log -SyslogIdentifier=__APP__ +StandardError=inherit Restart=always +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG + [Install] -WantedBy=multi-user.target +WantedBy=default.target