SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

analyze security: check for ProtectHostname=yes

Browse Source
This commit is contained in:
Topi Miettinen
2019-02-27 16:20:38 +01:00
committed by Zbigniew Jędrzejewski-Szmek
parent 6227fc14c4
commit 527bd7f185
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/analyze/analyze-security.c
+12
View File
@@ -49,6 +49,7 @@ struct security_info {
bool memory_deny_write_execute;
bool no_new_privileges;
char *notify_access;
bool protect_hostname;
bool private_devices;
bool private_mounts;
@@ -768,6 +769,16 @@ static const struct security_assessor security_assessor_table[] = {
.assess = assess_protect_home,
.default_dependencies_only = true,
},
{
.id = "ProtectHostname=",
.description_good = "Service cannot change system host/domainname",
.description_bad = "Service may change system host/domainname",
.url = "https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectHostname=",
.weight = 50,
.range = 1,
.assess = assess_bool,
.offset = offsetof(struct security_info, protect_hostname),
},
{
.id = "ProtectSystem=",
.url = "https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectSystem=",
@@ -1861,6 +1872,7 @@ static int acquire_security_info(sd_bus *bus, const char *name, struct security_
{ "PrivateUsers", "b", NULL, offsetof(struct security_info, private_users) },
{ "ProtectControlGroups", "b", NULL, offsetof(struct security_info, protect_control_groups) },
{ "ProtectHome", "s", NULL, offsetof(struct security_info, protect_home) },
{ "ProtectHostname", "b", NULL, offsetof(struct security_info, protect_hostname) },
{ "ProtectKernelModules", "b", NULL, offsetof(struct security_info, protect_kernel_modules) },
{ "ProtectKernelTunables", "b", NULL, offsetof(struct security_info, protect_kernel_tunables) },
{ "ProtectSystem", "s", NULL, offsetof(struct security_info, protect_system) },