From 4bb0f81643486b185e708ed498c851e4cce1c051 Mon Sep 17 00:00:00 2001 From: James Valleroy Date: Fri, 5 Nov 2021 15:41:31 -0400 Subject: [PATCH] avahi: Use systemd sandboxing Sandbox coverage is 35%. Tests: - Functional tests passed. - Diagnostics passed. - FreedomBox services are visible in Avahi Zeroconf Browser. Signed-off-by: James Valleroy Reviewed-by: Sunil Mohan Adapa --- .../system/avahi-daemon.service.d/freedombox.conf | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 plinth/modules/avahi/data/usr/lib/systemd/system/avahi-daemon.service.d/freedombox.conf diff --git a/plinth/modules/avahi/data/usr/lib/systemd/system/avahi-daemon.service.d/freedombox.conf b/plinth/modules/avahi/data/usr/lib/systemd/system/avahi-daemon.service.d/freedombox.conf new file mode 100644 index 000000000..09e2117cd --- /dev/null +++ b/plinth/modules/avahi/data/usr/lib/systemd/system/avahi-daemon.service.d/freedombox.conf @@ -0,0 +1,15 @@ +[Service] +LockPersonality=yes +NoNewPrivileges=yes +PrivateDevices=yes +PrivateMounts=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=full +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictRealtime=yes +SystemCallArchitectures=native