From 357e1b17b901b48714fa5301c745ae5389661798 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 9 Feb 2017 10:16:52 +0100 Subject: [PATCH 1/7] dhcp-server: add two missing OOM checks --- src/libsystemd-network/sd-dhcp-server.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c index 2890681561..315cbf1ac5 100644 --- a/src/libsystemd-network/sd-dhcp-server.c +++ b/src/libsystemd-network/sd-dhcp-server.c @@ -197,7 +197,11 @@ int sd_dhcp_server_new(sd_dhcp_server **ret, int ifindex) { server->address = htobe32(INADDR_ANY); server->netmask = htobe32(INADDR_ANY); server->ifindex = ifindex; + server->leases_by_client_id = hashmap_new(&client_id_hash_ops); + if (!server->leases_by_client_id) + return -ENOMEM; + server->default_lease_time = DIV_ROUND_UP(DHCP_DEFAULT_LEASE_TIME_USEC, USEC_PER_SEC); server->max_lease_time = DIV_ROUND_UP(DHCP_MAX_LEASE_TIME_USEC, USEC_PER_SEC); @@ -857,6 +861,8 @@ int dhcp_server_handle_message(sd_dhcp_server *server, DHCPMessage *message, if (!existing_lease) { lease = new0(DHCPLease, 1); + if (!lease) + return -ENOMEM; lease->address = address; lease->client_id.data = memdup(req->client_id.data, req->client_id.length); From 7f396e5f66e91caf450890c34bc9e00b717aae86 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 8 Feb 2017 22:32:37 +0100 Subject: [PATCH 2/7] units: set SystemCallArchitectures=native on all our long-running services --- units/systemd-ask-password-console.service.in | 1 + units/systemd-ask-password-wall.service.in | 1 + units/systemd-coredump@.service.in | 1 + units/systemd-hostnamed.service.in | 1 + units/systemd-importd.service.in | 1 + units/systemd-initctl.service.in | 3 ++- units/systemd-journal-gatewayd.service.in | 1 + units/systemd-journal-remote.service.in | 1 + units/systemd-journal-upload.service.in | 1 + units/systemd-journald.service.in | 1 + units/systemd-localed.service.in | 1 + units/systemd-logind.service.in | 1 + units/systemd-machined.service.in | 1 + units/systemd-networkd.service.m4.in | 1 + units/systemd-resolved.service.m4.in | 1 + units/systemd-timedated.service.in | 1 + units/systemd-timesyncd.service.in | 1 + units/systemd-udevd.service.in | 1 + 18 files changed, 19 insertions(+), 1 deletion(-) diff --git a/units/systemd-ask-password-console.service.in b/units/systemd-ask-password-console.service.in index a24fa51903..adaa60da87 100644 --- a/units/systemd-ask-password-console.service.in +++ b/units/systemd-ask-password-console.service.in @@ -16,3 +16,4 @@ ConditionPathExists=!/run/plymouth/pid [Service] ExecStart=@rootbindir@/systemd-tty-ask-password-agent --watch --console +SystemCallArchitectures=native diff --git a/units/systemd-ask-password-wall.service.in b/units/systemd-ask-password-wall.service.in index 0eaa274794..be380023a7 100644 --- a/units/systemd-ask-password-wall.service.in +++ b/units/systemd-ask-password-wall.service.in @@ -13,3 +13,4 @@ After=systemd-user-sessions.service [Service] ExecStartPre=-@SYSTEMCTL@ stop systemd-ask-password-console.path systemd-ask-password-console.service systemd-ask-password-plymouth.path systemd-ask-password-plymouth.service ExecStart=@rootbindir@/systemd-tty-ask-password-agent --wall +SystemCallArchitectures=native diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 588c8d629c..8ae296ff2b 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -22,3 +22,4 @@ OOMScoreAdjust=500 PrivateNetwork=yes ProtectSystem=full RuntimeMaxSec=5min +SystemCallArchitectures=native diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index edc5a1722a..89d942b072 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -26,3 +26,4 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallArchitectures=native diff --git a/units/systemd-importd.service.in b/units/systemd-importd.service.in index ac27c2bcba..2a8a683d95 100644 --- a/units/systemd-importd.service.in +++ b/units/systemd-importd.service.in @@ -21,3 +21,4 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io +SystemCallArchitectures=native diff --git a/units/systemd-initctl.service.in b/units/systemd-initctl.service.in index 27e663c8dc..5505309e92 100644 --- a/units/systemd-initctl.service.in +++ b/units/systemd-initctl.service.in @@ -11,5 +11,6 @@ Documentation=man:systemd-initctl.service(8) DefaultDependencies=no [Service] -ExecStart=@rootlibexecdir@/systemd-initctl NotifyAccess=all +ExecStart=@rootlibexecdir@/systemd-initctl +SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index efefaa4244..b0b934deb2 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -25,6 +25,7 @@ ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +SystemCallArchitectures=native # If there are many split upjournal files we need a lot of fds to # access them all and combine diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index 753dd6c158..bc384b8382 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -25,6 +25,7 @@ ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +SystemCallArchitectures=native [Install] Also=systemd-journal-remote.socket diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index d8fd243620..d28a62bb35 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -25,6 +25,7 @@ ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +SystemCallArchitectures=native # If there are many split up journal files we need a lot of fds to # access them all and combine diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 712ce55483..b2e7eeeda3 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -28,6 +28,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallArchitectures=native # Increase the default a bit in order to allow many simultaneous # services being run since we keep one fd open per service. Also, when diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index df829e1164..af2cdfffbe 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -26,3 +26,4 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallArchitectures=native diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 0b6de35733..fcbfd1debe 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -29,6 +29,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io +SystemCallArchitectures=native # Increase the default a bit in order to allow many simultaneous # logins since we keep one fd open per session. diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index 911ead79ee..3c46d04f64 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -21,6 +21,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io +SystemCallArchitectures=native # Note that machined cannot be placed in a mount namespace, since it # needs access to the host's mount namespace in order to implement the diff --git a/units/systemd-networkd.service.m4.in b/units/systemd-networkd.service.m4.in index d1cf3fc133..4596d31d0f 100644 --- a/units/systemd-networkd.service.m4.in +++ b/units/systemd-networkd.service.m4.in @@ -35,6 +35,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallArchitectures=native [Install] WantedBy=multi-user.target diff --git a/units/systemd-resolved.service.m4.in b/units/systemd-resolved.service.m4.in index 0f0440ddaf..dcacbdaeab 100644 --- a/units/systemd-resolved.service.m4.in +++ b/units/systemd-resolved.service.m4.in @@ -35,6 +35,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallArchitectures=native [Install] WantedBy=multi-user.target diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index e8c4d5ed4b..7608d9da28 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -24,3 +24,4 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallArchitectures=native diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 9a6c6ea60d..46b81ebab3 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -34,6 +34,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallArchitectures=native [Install] WantedBy=sysinit.target diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in index 46d637883b..fc037b5a5c 100644 --- a/units/systemd-udevd.service.in +++ b/units/systemd-udevd.service.in @@ -28,3 +28,4 @@ MountFlags=slave MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +SystemCallArchitectures=native From 3c19d0b46bb05aef5dcaa2ce83c31b15ee8ae11b Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 9 Feb 2017 10:28:23 +0100 Subject: [PATCH 3/7] units: restrict namespace for a good number of our own services Basically, we turn it on for most long-running services, with the exception of machined (whose child processes need to join containers here and there), and importd (which sandboxes tar in a CLONE_NEWNET namespace). machined is left unrestricted, and importd is restricted to use only "net" --- units/systemd-hostnamed.service.in | 1 + units/systemd-importd.service.in | 1 + units/systemd-journal-gatewayd.service.in | 1 + units/systemd-journal-remote.service.in | 1 + units/systemd-journal-upload.service.in | 1 + units/systemd-journald.service.in | 1 + units/systemd-localed.service.in | 1 + units/systemd-logind.service.in | 1 + units/systemd-timedated.service.in | 1 + units/systemd-timesyncd.service.in | 1 + 10 files changed, 10 insertions(+) diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 89d942b072..8a551403cf 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-importd.service.in b/units/systemd-importd.service.in index 2a8a683d95..de2431739f 100644 --- a/units/systemd-importd.service.in +++ b/units/systemd-importd.service.in @@ -19,6 +19,7 @@ CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_ NoNewPrivileges=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=net RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index b0b934deb2..677cb2a04b 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index bc384b8382..cab7778ddc 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index d28a62bb35..f539c7dc1f 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index b2e7eeeda3..adabedd977 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -26,6 +26,7 @@ FileDescriptorStoreMax=1024 CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index af2cdfffbe..1b6c163ef4 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index fcbfd1debe..93abeb3dca 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -27,6 +27,7 @@ WatchdogSec=3min CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 7608d9da28..26756d6e01 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -22,6 +22,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 46b81ebab3..5eb3f2362f 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -32,6 +32,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native From c7fb922d6250543ba5462fa7a6ff03cc8f628e94 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 9 Feb 2017 10:58:28 +0100 Subject: [PATCH 4/7] units: switch on ProtectSystem=strict for our long running services Let's step up the protection a notch --- units/systemd-coredump@.service.in | 3 ++- units/systemd-hostnamed.service.in | 3 ++- units/systemd-journal-gatewayd.service.in | 2 +- units/systemd-journal-remote.service.in | 3 ++- units/systemd-journal-upload.service.in | 2 +- units/systemd-localed.service.in | 3 ++- units/systemd-networkd.service.m4.in | 3 ++- units/systemd-resolved.service.m4.in | 3 ++- units/systemd-timedated.service.in | 3 ++- units/systemd-timesyncd.service.in | 3 ++- 10 files changed, 18 insertions(+), 10 deletions(-) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 8ae296ff2b..760769191c 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -20,6 +20,7 @@ ExecStart=-@rootlibexecdir@/systemd-coredump Nice=9 OOMScoreAdjust=500 PrivateNetwork=yes -ProtectSystem=full +ProtectSystem=strict RuntimeMaxSec=5min SystemCallArchitectures=native +ReadWritePaths=/var/lib/systemd/coredump diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 8a551403cf..6904785e45 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -18,7 +18,7 @@ CapabilityBoundingSet=CAP_SYS_ADMIN PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=yes +ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes @@ -28,3 +28,4 @@ RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native +ReadWritePaths=/etc diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index 677cb2a04b..ecc5b56c9c 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -18,7 +18,7 @@ SupplementaryGroups=systemd-journal PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=full +ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index cab7778ddc..323e308871 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -18,7 +18,7 @@ WatchdogSec=3min PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=full +ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes @@ -27,6 +27,7 @@ RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native +ReadWritePaths=/var/log/journal/remote [Install] Also=systemd-journal-remote.socket diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index f539c7dc1f..d7e0b290e9 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -18,7 +18,7 @@ SupplementaryGroups=systemd-journal WatchdogSec=3min PrivateTmp=yes PrivateDevices=yes -ProtectSystem=full +ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index 1b6c163ef4..d6441d9f5f 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -18,7 +18,7 @@ CapabilityBoundingSet= PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=yes +ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes @@ -28,3 +28,4 @@ RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native +ReadWritePaths=/etc diff --git a/units/systemd-networkd.service.m4.in b/units/systemd-networkd.service.m4.in index 4596d31d0f..153ddeb323 100644 --- a/units/systemd-networkd.service.m4.in +++ b/units/systemd-networkd.service.m4.in @@ -28,7 +28,7 @@ RestartSec=0 ExecStart=@rootlibexecdir@/systemd-networkd WatchdogSec=3min CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER -ProtectSystem=full +ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes MemoryDenyWriteExecute=yes @@ -36,6 +36,7 @@ RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native +ReadWritePaths=/run/systemd [Install] WantedBy=multi-user.target diff --git a/units/systemd-resolved.service.m4.in b/units/systemd-resolved.service.m4.in index dcacbdaeab..dfd2f4ad0a 100644 --- a/units/systemd-resolved.service.m4.in +++ b/units/systemd-resolved.service.m4.in @@ -27,7 +27,7 @@ WatchdogSec=3min CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_NET_RAW CAP_NET_BIND_SERVICE PrivateTmp=yes PrivateDevices=yes -ProtectSystem=full +ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes @@ -36,6 +36,7 @@ RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native +ReadWritePaths=/run/systemd [Install] WantedBy=multi-user.target diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 26756d6e01..336a231290 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -16,7 +16,7 @@ BusName=org.freedesktop.timedate1 WatchdogSec=3min CapabilityBoundingSet=CAP_SYS_TIME PrivateTmp=yes -ProtectSystem=yes +ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes @@ -26,3 +26,4 @@ RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native +ReadWritePaths=/etc diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 5eb3f2362f..41d41806c1 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -26,7 +26,7 @@ WatchdogSec=3min CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER PrivateTmp=yes PrivateDevices=yes -ProtectSystem=full +ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes @@ -36,6 +36,7 @@ RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native +ReadWritePaths=/var/lib/systemd [Install] WantedBy=sysinit.target From b6c7278c38b5c240d8435ab6293838ee5de827cb Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 9 Feb 2017 11:09:50 +0100 Subject: [PATCH 5/7] units: turn on ProtectKernelModules= for most long-running services --- units/systemd-coredump@.service.in | 1 + units/systemd-hostnamed.service.in | 1 + units/systemd-journal-gatewayd.service.in | 1 + units/systemd-journal-remote.service.in | 1 + units/systemd-journal-upload.service.in | 1 + units/systemd-localed.service.in | 1 + units/systemd-networkd.service.m4.in | 1 + units/systemd-resolved.service.m4.in | 1 + units/systemd-timedated.service.in | 1 + units/systemd-timesyncd.service.in | 1 + 10 files changed, 10 insertions(+) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 760769191c..f12b28d6a6 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -24,3 +24,4 @@ ProtectSystem=strict RuntimeMaxSec=5min SystemCallArchitectures=native ReadWritePaths=/var/lib/systemd/coredump +ProtectKernelModules=yes diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 6904785e45..85410adc72 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -22,6 +22,7 @@ ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes +ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index ecc5b56c9c..99099967e7 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -22,6 +22,7 @@ ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes +ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index 323e308871..5404bf1c03 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -22,6 +22,7 @@ ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes +ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index d7e0b290e9..b9eab21542 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -22,6 +22,7 @@ ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes +ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index d6441d9f5f..a41e30bfdf 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -22,6 +22,7 @@ ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes +ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes diff --git a/units/systemd-networkd.service.m4.in b/units/systemd-networkd.service.m4.in index 153ddeb323..d33deb97b6 100644 --- a/units/systemd-networkd.service.m4.in +++ b/units/systemd-networkd.service.m4.in @@ -31,6 +31,7 @@ CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_N ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes +ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET diff --git a/units/systemd-resolved.service.m4.in b/units/systemd-resolved.service.m4.in index dfd2f4ad0a..08f0a85aea 100644 --- a/units/systemd-resolved.service.m4.in +++ b/units/systemd-resolved.service.m4.in @@ -31,6 +31,7 @@ ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes +ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 336a231290..2881e122dc 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -20,6 +20,7 @@ ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes +ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 41d41806c1..ab48a7aa30 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -30,6 +30,7 @@ ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes +ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes From 924453c22599cc246746a0233b2f52a27ade0819 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 9 Feb 2017 11:17:45 +0100 Subject: [PATCH 6/7] units: lock down coredump service a bit Dissecting a coredump is possibly risky and might take a while, hence lock down the unit as much as we can. --- units/systemd-coredump@.service.in | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index f12b28d6a6..18f2d2d605 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -19,9 +19,19 @@ Before=shutdown.target ExecStart=-@rootlibexecdir@/systemd-coredump Nice=9 OOMScoreAdjust=500 +RuntimeMaxSec=5min +PrivateTmp=yes +PrivateDevices=yes PrivateNetwork=yes ProtectSystem=strict -RuntimeMaxSec=5min +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native ReadWritePaths=/var/lib/systemd/coredump -ProtectKernelModules=yes From 6489ccfe48bb21a43694b60173a49d140b4fb91f Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 9 Feb 2017 11:22:08 +0100 Subject: [PATCH 7/7] units: make use of @reboot and @swap in our long-running service SystemCallFilter= settings Tighten security up a bit more. --- units/systemd-hostnamed.service.in | 2 +- units/systemd-importd.service.in | 2 +- units/systemd-journald.service.in | 2 +- units/systemd-localed.service.in | 2 +- units/systemd-logind.service.in | 2 +- units/systemd-machined.service.in | 2 +- units/systemd-networkd.service.m4.in | 2 +- units/systemd-resolved.service.m4.in | 2 +- units/systemd-timedated.service.in | 2 +- units/systemd-timesyncd.service.in | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 85410adc72..01a8ec9f57 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -27,6 +27,6 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native ReadWritePaths=/etc diff --git a/units/systemd-importd.service.in b/units/systemd-importd.service.in index de2431739f..75585d5dbc 100644 --- a/units/systemd-importd.service.in +++ b/units/systemd-importd.service.in @@ -21,5 +21,5 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=net RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap SystemCallArchitectures=native diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index adabedd977..64253f59d4 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -28,7 +28,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native # Increase the default a bit in order to allow many simultaneous diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index a41e30bfdf..f76012a34c 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -27,6 +27,6 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native ReadWritePaths=/etc diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 93abeb3dca..e20a3ad057 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -29,7 +29,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap SystemCallArchitectures=native # Increase the default a bit in order to allow many simultaneous diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index 3c46d04f64..0b0bbf272c 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -20,7 +20,7 @@ CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_C MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap SystemCallArchitectures=native # Note that machined cannot be placed in a mount namespace, since it diff --git a/units/systemd-networkd.service.m4.in b/units/systemd-networkd.service.m4.in index d33deb97b6..c3f153046a 100644 --- a/units/systemd-networkd.service.m4.in +++ b/units/systemd-networkd.service.m4.in @@ -35,7 +35,7 @@ ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native ReadWritePaths=/run/systemd diff --git a/units/systemd-resolved.service.m4.in b/units/systemd-resolved.service.m4.in index 08f0a85aea..820e299168 100644 --- a/units/systemd-resolved.service.m4.in +++ b/units/systemd-resolved.service.m4.in @@ -35,7 +35,7 @@ ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native ReadWritePaths=/run/systemd diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 2881e122dc..f691f47517 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -25,6 +25,6 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX -SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native ReadWritePaths=/etc diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index ab48a7aa30..8d328bb80a 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -35,7 +35,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io +SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native ReadWritePaths=/var/lib/systemd