|
 |
ddca0b |
From b0573f1a6f8022aed4954d5ca19cc037d25cd5e7 Mon Sep 17 00:00:00 2001
|
|
|
ddca0b |
From: Lennart Poettering <lennart@poettering.net>
|
|
|
ddca0b |
Date: Wed, 20 Mar 2019 19:52:20 +0100
|
|
|
ddca0b |
Subject: [PATCH] units: turn on RestrictSUIDSGID= in most of our long-running
|
|
|
ddca0b |
daemons
|
|
|
ddca0b |
|
|
|
ddca0b |
(cherry picked from commit 62aa29247c3d74bcec0607c347f2be23cd90675d)
|
|
|
ddca0b |
Related: #1687512
|
|
|
ddca0b |
---
|
|
|
ddca0b |
units/systemd-coredump@.service.in | 1 +
|
|
|
ddca0b |
units/systemd-hostnamed.service.in | 1 +
|
|
|
ddca0b |
units/systemd-journal-remote.service.in | 1 +
|
|
|
ddca0b |
units/systemd-journald.service.in | 1 +
|
|
|
ddca0b |
units/systemd-localed.service.in | 1 +
|
|
|
ddca0b |
units/systemd-logind.service.in | 1 +
|
|
|
ddca0b |
units/systemd-networkd.service.in | 1 +
|
|
|
ddca0b |
units/systemd-resolved.service.in | 1 +
|
|
|
ddca0b |
units/systemd-timedated.service.in | 1 +
|
|
|
ddca0b |
units/systemd-timesyncd.service.in | 1 +
|
|
|
ddca0b |
units/systemd-udevd.service.in | 3 ++-
|
|
|
ddca0b |
11 files changed, 12 insertions(+), 1 deletion(-)
|
|
|
ddca0b |
|
|
|
ddca0b |
diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in
|
|
|
ddca0b |
index 68a68a5055..d69ebd8b24 100644
|
|
|
ddca0b |
--- a/units/systemd-coredump@.service.in
|
|
|
ddca0b |
+++ b/units/systemd-coredump@.service.in
|
|
|
ddca0b |
@@ -33,6 +33,7 @@ MemoryDenyWriteExecute=yes
|
|
|
ddca0b |
RestrictRealtime=yes
|
|
|
ddca0b |
RestrictNamespaces=yes
|
|
|
ddca0b |
RestrictAddressFamilies=AF_UNIX
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
SystemCallFilter=@system-service
|
|
|
ddca0b |
SystemCallErrorNumber=EPERM
|
|
|
ddca0b |
SystemCallArchitectures=native
|
|
|
ddca0b |
diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in
|
|
|
ddca0b |
index 4e5470dd29..97d4e142bc 100644
|
|
|
ddca0b |
--- a/units/systemd-hostnamed.service.in
|
|
|
ddca0b |
+++ b/units/systemd-hostnamed.service.in
|
|
|
ddca0b |
@@ -29,6 +29,7 @@ MemoryDenyWriteExecute=yes
|
|
|
ddca0b |
RestrictRealtime=yes
|
|
|
ddca0b |
RestrictNamespaces=yes
|
|
|
ddca0b |
RestrictAddressFamilies=AF_UNIX
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
SystemCallFilter=@system-service sethostname
|
|
|
ddca0b |
SystemCallErrorNumber=EPERM
|
|
|
ddca0b |
SystemCallArchitectures=native
|
|
|
ddca0b |
diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in
|
|
|
ddca0b |
index a94265f215..3c914f5a40 100644
|
|
|
ddca0b |
--- a/units/systemd-journal-remote.service.in
|
|
|
ddca0b |
+++ b/units/systemd-journal-remote.service.in
|
|
|
ddca0b |
@@ -28,6 +28,7 @@ MemoryDenyWriteExecute=yes
|
|
|
ddca0b |
RestrictRealtime=yes
|
|
|
ddca0b |
RestrictNamespaces=yes
|
|
|
ddca0b |
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
SystemCallArchitectures=native
|
|
|
ddca0b |
LockPersonality=yes
|
|
|
ddca0b |
LogsDirectory=journal/remote
|
|
|
ddca0b |
diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in
|
|
|
ddca0b |
index e109b25792..ab9ec35ff8 100644
|
|
|
ddca0b |
--- a/units/systemd-journald.service.in
|
|
|
ddca0b |
+++ b/units/systemd-journald.service.in
|
|
|
ddca0b |
@@ -21,6 +21,7 @@ Sockets=systemd-journald.socket systemd-journald-dev-log.socket
|
|
|
ddca0b |
ExecStart=@rootlibexecdir@/systemd-journald
|
|
|
ddca0b |
Restart=always
|
|
|
ddca0b |
RestartSec=0
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
StandardOutput=null
|
|
|
ddca0b |
WatchdogSec=3min
|
|
|
ddca0b |
FileDescriptorStoreMax=4224
|
|
|
ddca0b |
diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in
|
|
|
ddca0b |
index ce043db154..b87d60e9eb 100644
|
|
|
ddca0b |
--- a/units/systemd-localed.service.in
|
|
|
ddca0b |
+++ b/units/systemd-localed.service.in
|
|
|
ddca0b |
@@ -29,6 +29,7 @@ MemoryDenyWriteExecute=yes
|
|
|
ddca0b |
RestrictRealtime=yes
|
|
|
ddca0b |
RestrictNamespaces=yes
|
|
|
ddca0b |
RestrictAddressFamilies=AF_UNIX
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
SystemCallFilter=@system-service
|
|
|
ddca0b |
SystemCallErrorNumber=EPERM
|
|
|
ddca0b |
SystemCallArchitectures=native
|
|
|
ddca0b |
diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in
|
|
|
ddca0b |
index 6953fac55b..086338e03b 100644
|
|
|
ddca0b |
--- a/units/systemd-logind.service.in
|
|
|
ddca0b |
+++ b/units/systemd-logind.service.in
|
|
|
ddca0b |
@@ -30,6 +30,7 @@ MemoryDenyWriteExecute=yes
|
|
|
ddca0b |
RestrictRealtime=yes
|
|
|
ddca0b |
RestrictNamespaces=yes
|
|
|
ddca0b |
RestrictAddressFamilies=AF_UNIX AF_NETLINK
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
SystemCallFilter=@system-service
|
|
|
ddca0b |
SystemCallErrorNumber=EPERM
|
|
|
ddca0b |
SystemCallArchitectures=native
|
|
|
ddca0b |
diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in
|
|
|
ddca0b |
index 371ab3a9cf..a0f34ac738 100644
|
|
|
ddca0b |
--- a/units/systemd-networkd.service.in
|
|
|
ddca0b |
+++ b/units/systemd-networkd.service.in
|
|
|
ddca0b |
@@ -39,6 +39,7 @@ SystemCallFilter=@system-service
|
|
|
ddca0b |
SystemCallErrorNumber=EPERM
|
|
|
ddca0b |
SystemCallArchitectures=native
|
|
|
ddca0b |
LockPersonality=yes
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
RuntimeDirectory=systemd/netif
|
|
|
ddca0b |
RuntimeDirectoryPreserve=yes
|
|
|
ddca0b |
|
|
|
ddca0b |
diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in
|
|
|
ddca0b |
index aaed406ab2..6c2ad5ca86 100644
|
|
|
ddca0b |
--- a/units/systemd-resolved.service.in
|
|
|
ddca0b |
+++ b/units/systemd-resolved.service.in
|
|
|
ddca0b |
@@ -41,6 +41,7 @@ SystemCallFilter=@system-service
|
|
|
ddca0b |
SystemCallErrorNumber=EPERM
|
|
|
ddca0b |
SystemCallArchitectures=native
|
|
|
ddca0b |
LockPersonality=yes
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
RuntimeDirectory=systemd/resolve
|
|
|
ddca0b |
RuntimeDirectoryPreserve=yes
|
|
|
ddca0b |
|
|
|
ddca0b |
diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in
|
|
|
ddca0b |
index 662b39557a..1da2bc4bb0 100644
|
|
|
ddca0b |
--- a/units/systemd-timedated.service.in
|
|
|
ddca0b |
+++ b/units/systemd-timedated.service.in
|
|
|
ddca0b |
@@ -27,6 +27,7 @@ MemoryDenyWriteExecute=yes
|
|
|
ddca0b |
RestrictRealtime=yes
|
|
|
ddca0b |
RestrictNamespaces=yes
|
|
|
ddca0b |
RestrictAddressFamilies=AF_UNIX
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
SystemCallFilter=@system-service @clock
|
|
|
ddca0b |
SystemCallErrorNumber=EPERM
|
|
|
ddca0b |
SystemCallArchitectures=native
|
|
|
ddca0b |
diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in
|
|
|
ddca0b |
index 4a490b6e16..c2b9551726 100644
|
|
|
ddca0b |
--- a/units/systemd-timesyncd.service.in
|
|
|
ddca0b |
+++ b/units/systemd-timesyncd.service.in
|
|
|
ddca0b |
@@ -37,6 +37,7 @@ MemoryDenyWriteExecute=yes
|
|
|
ddca0b |
RestrictRealtime=yes
|
|
|
ddca0b |
RestrictNamespaces=yes
|
|
|
ddca0b |
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
RuntimeDirectory=systemd/timesync
|
|
|
ddca0b |
SystemCallFilter=@system-service @clock
|
|
|
ddca0b |
SystemCallErrorNumber=EPERM
|
|
|
ddca0b |
diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in
|
|
|
ddca0b |
index fd9ead3bb8..970cf0f290 100644
|
|
|
ddca0b |
--- a/units/systemd-udevd.service.in
|
|
|
ddca0b |
+++ b/units/systemd-udevd.service.in
|
|
|
ddca0b |
@@ -27,8 +27,9 @@ WatchdogSec=3min
|
|
|
ddca0b |
TasksMax=infinity
|
|
|
ddca0b |
PrivateMounts=yes
|
|
|
ddca0b |
MemoryDenyWriteExecute=yes
|
|
|
ddca0b |
-RestrictRealtime=yes
|
|
|
ddca0b |
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
|
|
|
ddca0b |
+RestrictRealtime=yes
|
|
|
ddca0b |
+RestrictSUIDSGID=yes
|
|
|
ddca0b |
SystemCallFilter=@system-service @module @raw-io
|
|
|
ddca0b |
SystemCallErrorNumber=EPERM
|
|
|
ddca0b |
SystemCallArchitectures=native
|