From c7c9d49939a8409725151c4e29f4193f929c8831 Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa Date: Sat, 9 Oct 2021 19:19:46 -0700 Subject: [PATCH] ttrss: Add systemd security hardening to daemon MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit → Overall exposure level for tt-rss.service: 1.1 OK 🙂 Tests: - Run ./setup.py install. systemctl daemon-reload. Subscribe to a new feed and don't wait for it load the feed. Then start/restart the daemon. The daemon successfully fetches the feed. When tt-rss interface is loaded again the feed items are available. - For getting output of the daemon add StandardOutput=journal option to the service file. Signed-off-by: Sunil Mohan Adapa Reviewed-by: James Valleroy --- .../system/tt-rss.service.d/freedombox.conf | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/plinth/modules/ttrss/data/usr/lib/systemd/system/tt-rss.service.d/freedombox.conf b/plinth/modules/ttrss/data/usr/lib/systemd/system/tt-rss.service.d/freedombox.conf index ee82c0fc7..e5c1a5d7a 100644 --- a/plinth/modules/ttrss/data/usr/lib/systemd/system/tt-rss.service.d/freedombox.conf +++ b/plinth/modules/ttrss/data/usr/lib/systemd/system/tt-rss.service.d/freedombox.conf @@ -2,5 +2,34 @@ # database temporarily, it will exist with exit code 101. 120 seconds is the # default daemon sleep interval for tt-rss. [Service] +CacheDirectory=tt-rss +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER CAP_NET_ADMIN CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE CAP_KILL CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_LINUX_IMMUTABLE CAP_IPC_LOCK CAP_SYS_CHROOT CAP_BLOCK_SUSPEND CAP_LEASE CAP_SYS_PACCT CAP_SYS_TTY_CONFIG CAP_SYS_BOOT CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_SYS_NICE CAP_SYS_RESOURCE +DevicePolicy=closed +LockPersonality=yes +NoNewPrivileges=yes +PrivateDevices=yes +PrivateMounts=yes +PrivateTmp=yes +PrivateUsers=yes +ProtectControlGroups=yes +ProtectClock=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectProc=invisible +ProtectSystem=strict +RemoveIPC=yes Restart=always RestartSec=120s +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictSUIDSGID=yes +RestrictRealtime=yes +StateDirectory=tt-rss +SystemCallArchitectures=native +SystemCallFilter=@system-service +SystemCallFilter=~@resources +SystemCallFilter=~@privileged +SystemCallErrorNumber=EPERM