From 04c65645fa33a08aed5aaa0981eeed9957a206fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 18 Dec 2018 14:02:56 +0100 Subject: [PATCH 1/5] Revert "units: set NoNewPrivileges= for all long-running services" This reverts commit 3ca9940cb95cb263c6bfe5cfee72df232fe46a94. Let's split the commit in two: the sorting and the changes. Because there's a requirement to update selinux policy, this change is incompatible, strictly speaking. I expect that distributions might want to revert this particular change. Let's make it easy. --- units/systemd-coredump@.service.in | 29 +++++++-------- units/systemd-hostnamed.service.in | 33 ++++++++--------- units/systemd-initctl.service.in | 3 +- units/systemd-journal-gatewayd.service.in | 19 +++++----- units/systemd-journal-remote.service.in | 31 ++++++++-------- units/systemd-journal-upload.service.in | 29 +++++++-------- units/systemd-journald.service.in | 27 +++++++------- units/systemd-localed.service.in | 33 ++++++++--------- units/systemd-logind.service.in | 25 ++++++------- units/systemd-machined.service.in | 21 +++++------ units/systemd-networkd.service.in | 35 +++++++++--------- units/systemd-resolved.service.in | 41 ++++++++++----------- units/systemd-rfkill.service.in | 7 ++-- units/systemd-timedated.service.in | 37 +++++++++---------- units/systemd-timesyncd.service.in | 45 +++++++++++------------ 15 files changed, 200 insertions(+), 215 deletions(-) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index ffcb5f36ca..215696ecd1 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -18,25 +18,24 @@ Before=shutdown.target [Service] ExecStart=-@rootlibexecdir@/systemd-coredump -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes Nice=9 -NoNewPrivileges=yes OOMScoreAdjust=500 +RuntimeMaxSec=5min +PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes ProtectSystem=strict -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -RuntimeMaxSec=5min -StateDirectory=systemd/coredump -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +StateDirectory=systemd/coredump diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 9c925e80d9..da74b4fe8b 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -13,26 +13,25 @@ Documentation=man:systemd-hostnamed.service(8) man:hostname(5) man:machine-info( Documentation=https://www.freedesktop.org/wiki/Software/systemd/hostnamed [Service] -BusName=org.freedesktop.hostname1 -CapabilityBoundingSet=CAP_SYS_ADMIN ExecStart=@rootlibexecdir@/systemd-hostnamed -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes +BusName=org.freedesktop.hostname1 +WatchdogSec=3min +CapabilityBoundingSet=CAP_SYS_ADMIN +PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes ProtectSystem=strict -ReadWritePaths=/etc -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX SystemCallFilter=@system-service sethostname -WatchdogSec=3min +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +ReadWritePaths=/etc diff --git a/units/systemd-initctl.service.in b/units/systemd-initctl.service.in index c276283908..2b4b957dce 100644 --- a/units/systemd-initctl.service.in +++ b/units/systemd-initctl.service.in @@ -13,7 +13,6 @@ Documentation=man:systemd-initctl.service(8) DefaultDependencies=no [Service] -ExecStart=@rootlibexecdir@/systemd-initctl -NoNewPrivileges=yes NotifyAccess=all +ExecStart=@rootlibexecdir@/systemd-initctl SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index ebc8bf9a25..a51d59d101 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -13,23 +13,22 @@ Documentation=man:systemd-journal-gatewayd(8) Requires=systemd-journal-gatewayd.socket [Service] -DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-gatewayd -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes +User=systemd-journal-gateway +SupplementaryGroups=systemd-journal +DynamicUser=yes PrivateDevices=yes PrivateNetwork=yes -ProtectControlGroups=yes ProtectHome=yes -ProtectKernelModules=yes +ProtectControlGroups=yes ProtectKernelTunables=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -SupplementaryGroups=systemd-journal +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native -User=systemd-journal-gateway +LockPersonality=yes # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index 29a99aaec1..fa8682cd28 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -14,24 +14,23 @@ Requires=systemd-journal-remote.socket [Service] ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/ -LockPersonality=yes -LogsDirectory=journal/remote -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -SystemCallArchitectures=native User=systemd-journal-remote WatchdogSec=3min +PrivateTmp=yes +PrivateDevices=yes +PrivateNetwork=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +SystemCallArchitectures=native +LockPersonality=yes +LogsDirectory=journal/remote # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index 92cd4e5259..1ded990877 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -14,24 +14,23 @@ Wants=network-online.target After=network-online.target [Service] -DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -StateDirectory=systemd/journal-upload -SupplementaryGroups=systemd-journal -SystemCallArchitectures=native User=systemd-journal-upload +DynamicUser=yes +SupplementaryGroups=systemd-journal WatchdogSec=3min +PrivateDevices=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +SystemCallArchitectures=native +LockPersonality=yes +StateDirectory=systemd/journal-upload # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 4684f095c0..41cac8cf65 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -16,25 +16,24 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a Before=sysinit.target [Service] -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE +Type=notify +Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket ExecStart=@rootlibexecdir@/systemd-journald -FileDescriptorStoreMax=4224 -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket StandardOutput=null -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service -Type=notify WatchdogSec=3min +FileDescriptorStoreMax=4224 +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index 01e0703d0e..a24e61a0cd 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -13,26 +13,25 @@ Documentation=man:systemd-localed.service(8) man:locale.conf(5) man:vconsole.con Documentation=https://www.freedesktop.org/wiki/Software/systemd/localed [Service] -BusName=org.freedesktop.locale1 -CapabilityBoundingSet= ExecStart=@rootlibexecdir@/systemd-localed -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes +BusName=org.freedesktop.locale1 +WatchdogSec=3min +CapabilityBoundingSet= +PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes ProtectSystem=strict -ReadWritePaths=/etc -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX SystemCallFilter=@system-service -WatchdogSec=3min +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +ReadWritePaths=/etc diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 38a7f269ac..961263f607 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -20,23 +20,22 @@ Wants=dbus.socket After=dbus.socket [Service] -BusName=org.freedesktop.login1 -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG ExecStart=@rootlibexecdir@/systemd-logind -FileDescriptorStoreMax=512 -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service +BusName=org.freedesktop.login1 WatchdogSec=3min +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +FileDescriptorStoreMax=512 # Increase the default a bit in order to allow many simultaneous logins since # we keep one fd open per session. diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index 9f1476814d..1200a90a61 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -16,19 +16,18 @@ After=machine.slice RequiresMountsFor=/var/lib/machines [Service] -BusName=org.freedesktop.machine1 -CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD ExecStart=@rootlibexecdir@/systemd-machined -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service @mount +BusName=org.freedesktop.machine1 WatchdogSec=3min +CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +SystemCallFilter=@system-service @mount +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any # Note that machined cannot be placed in a mount namespace, since it # needs access to the host's mount namespace in order to implement the diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 472ef045de..65d3e2a660 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -19,29 +19,28 @@ Conflicts=shutdown.target Wants=network.target [Service] -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -ExecStart=!!@rootlibexecdir@/systemd-networkd -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectSystem=strict +Type=notify Restart=on-failure RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET -RestrictNamespaces=yes +ExecStart=!!@rootlibexecdir@/systemd-networkd +WatchdogSec=3min +User=systemd-network +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes RuntimeDirectory=systemd/netif RuntimeDirectoryPreserve=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service -Type=notify -User=systemd-network -WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index 3144b70063..ef5398cbf0 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -20,32 +20,31 @@ Conflicts=shutdown.target Wants=nss-lookup.target [Service] -AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -ExecStart=!!@rootlibexecdir@/systemd-resolved -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict +Type=notify Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -RestrictNamespaces=yes +ExecStart=!!@rootlibexecdir@/systemd-resolved +WatchdogSec=3min +User=systemd-resolve +CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes RuntimeDirectory=systemd/resolve RuntimeDirectoryPreserve=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service -Type=notify -User=systemd-resolve -WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-rfkill.service.in b/units/systemd-rfkill.service.in index 3abb958310..4b68f0b5a7 100644 --- a/units/systemd-rfkill.service.in +++ b/units/systemd-rfkill.service.in @@ -17,8 +17,7 @@ After=sys-devices-virtual-misc-rfkill.device systemd-remount-fs.service Before=shutdown.target [Service] -ExecStart=@rootlibexecdir@/systemd-rfkill -NoNewPrivileges=yes -StateDirectory=systemd/rfkill -TimeoutSec=30s Type=notify +ExecStart=@rootlibexecdir@/systemd-rfkill +TimeoutSec=30s +StateDirectory=systemd/rfkill diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 6d53024195..906bb4326c 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -13,24 +13,23 @@ Documentation=man:systemd-timedated.service(8) man:localtime(5) Documentation=https://www.freedesktop.org/wiki/Software/systemd/timedated [Service] -BusName=org.freedesktop.timedate1 -CapabilityBoundingSet=CAP_SYS_TIME ExecStart=@rootlibexecdir@/systemd-timedated -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict -ReadWritePaths=/etc -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes -RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service @clock +BusName=org.freedesktop.timedate1 WatchdogSec=3min +CapabilityBoundingSet=CAP_SYS_TIME +PrivateTmp=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX +SystemCallFilter=@system-service @clock +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +ReadWritePaths=/etc diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 03ade45d08..12f918dd11 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -19,32 +19,31 @@ Conflicts=shutdown.target Wants=time-sync.target [Service] -AmbientCapabilities=CAP_SYS_TIME -CapabilityBoundingSet=CAP_SYS_TIME -ExecStart=!!@rootlibexecdir@/systemd-timesyncd -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict +Type=notify Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -RuntimeDirectory=systemd/timesync -StateDirectory=systemd/timesync -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service @clock -Type=notify -User=systemd-timesync +ExecStart=!!@rootlibexecdir@/systemd-timesyncd WatchdogSec=3min +User=systemd-timesync +CapabilityBoundingSet=CAP_SYS_TIME +AmbientCapabilities=CAP_SYS_TIME +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RuntimeDirectory=systemd/timesync +SystemCallFilter=@system-service @clock +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +StateDirectory=systemd/timesync [Install] WantedBy=sysinit.target From 52ef7bbbe653aaecffdf49b54af148993f4db46b Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 18 Dec 2018 14:07:23 +0100 Subject: [PATCH 2/5] units: sort [Service] sections alphabetically --- units/systemd-coredump@.service.in | 26 +++++++-------- units/systemd-hostnamed.service.in | 30 ++++++++--------- units/systemd-initctl.service.in | 2 +- units/systemd-journal-gatewayd.service.in | 18 +++++----- units/systemd-journal-remote.service.in | 30 ++++++++--------- units/systemd-journal-upload.service.in | 28 ++++++++-------- units/systemd-journald.service.in | 26 +++++++-------- units/systemd-localed.service.in | 30 ++++++++--------- units/systemd-logind.service.in | 22 ++++++------- units/systemd-machined.service.in | 18 +++++----- units/systemd-networkd.service.in | 34 +++++++++---------- units/systemd-resolved.service.in | 40 +++++++++++------------ units/systemd-rfkill.service.in | 4 +-- units/systemd-timedated.service.in | 32 +++++++++--------- units/systemd-timesyncd.service.in | 40 +++++++++++------------ 15 files changed, 190 insertions(+), 190 deletions(-) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 215696ecd1..74dcf7fe06 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -18,24 +18,24 @@ Before=shutdown.target [Service] ExecStart=-@rootlibexecdir@/systemd-coredump +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes Nice=9 OOMScoreAdjust=500 -RuntimeMaxSec=5min -PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=strict -ProtectHome=yes +PrivateTmp=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes +ProtectKernelTunables=yes +ProtectSystem=strict RestrictAddressFamilies=AF_UNIX -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any +RestrictNamespaces=yes +RestrictRealtime=yes +RuntimeMaxSec=5min StateDirectory=systemd/coredump +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index da74b4fe8b..696d4e2e60 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -13,25 +13,25 @@ Documentation=man:systemd-hostnamed.service(8) man:hostname(5) man:machine-info( Documentation=https://www.freedesktop.org/wiki/Software/systemd/hostnamed [Service] -ExecStart=@rootlibexecdir@/systemd-hostnamed BusName=org.freedesktop.hostname1 -WatchdogSec=3min CapabilityBoundingSet=CAP_SYS_ADMIN -PrivateTmp=yes +ExecStart=@rootlibexecdir@/systemd-hostnamed +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=strict -ProtectHome=yes +PrivateTmp=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX -SystemCallFilter=@system-service sethostname -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any +ProtectKernelTunables=yes +ProtectSystem=strict ReadWritePaths=/etc +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service sethostname +WatchdogSec=3min diff --git a/units/systemd-initctl.service.in b/units/systemd-initctl.service.in index 2b4b957dce..f48d673d58 100644 --- a/units/systemd-initctl.service.in +++ b/units/systemd-initctl.service.in @@ -13,6 +13,6 @@ Documentation=man:systemd-initctl.service(8) DefaultDependencies=no [Service] -NotifyAccess=all ExecStart=@rootlibexecdir@/systemd-initctl +NotifyAccess=all SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index a51d59d101..5ef4ee0058 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -13,22 +13,22 @@ Documentation=man:systemd-journal-gatewayd(8) Requires=systemd-journal-gatewayd.socket [Service] -ExecStart=@rootlibexecdir@/systemd-journal-gatewayd -User=systemd-journal-gateway -SupplementaryGroups=systemd-journal DynamicUser=yes +ExecStart=@rootlibexecdir@/systemd-journal-gatewayd +LockPersonality=yes +MemoryDenyWriteExecute=yes PrivateDevices=yes PrivateNetwork=yes -ProtectHome=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes +ProtectKernelTunables=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +SupplementaryGroups=systemd-journal SystemCallArchitectures=native -LockPersonality=yes +User=systemd-journal-gateway # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index fa8682cd28..ec1311da88 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -14,23 +14,23 @@ Requires=systemd-journal-remote.socket [Service] ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/ -User=systemd-journal-remote -WatchdogSec=3min -PrivateTmp=yes -PrivateDevices=yes -PrivateNetwork=yes -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -SystemCallArchitectures=native LockPersonality=yes LogsDirectory=journal/remote +MemoryDenyWriteExecute=yes +PrivateDevices=yes +PrivateNetwork=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +SystemCallArchitectures=native +User=systemd-journal-remote +WatchdogSec=3min # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index 1ded990877..a15744e1e8 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -14,23 +14,23 @@ Wants=network-online.target After=network-online.target [Service] -ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state -User=systemd-journal-upload DynamicUser=yes -SupplementaryGroups=systemd-journal -WatchdogSec=3min -PrivateDevices=yes -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -SystemCallArchitectures=native +ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state LockPersonality=yes +MemoryDenyWriteExecute=yes +PrivateDevices=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes StateDirectory=systemd/journal-upload +SupplementaryGroups=systemd-journal +SystemCallArchitectures=native +User=systemd-journal-upload +WatchdogSec=3min # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 41cac8cf65..7b659d4b03 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -16,24 +16,24 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a Before=sysinit.target [Service] -Type=notify -Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE ExecStart=@rootlibexecdir@/systemd-journald +FileDescriptorStoreMax=4224 +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes Restart=always RestartSec=0 -StandardOutput=null -WatchdogSec=3min -FileDescriptorStoreMax=4224 -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictRealtime=yes +Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket +StandardOutput=null SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +Type=notify +WatchdogSec=3min # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index a24e61a0cd..7d40fb4897 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -13,25 +13,25 @@ Documentation=man:systemd-localed.service(8) man:locale.conf(5) man:vconsole.con Documentation=https://www.freedesktop.org/wiki/Software/systemd/localed [Service] -ExecStart=@rootlibexecdir@/systemd-localed BusName=org.freedesktop.locale1 -WatchdogSec=3min CapabilityBoundingSet= -PrivateTmp=yes +ExecStart=@rootlibexecdir@/systemd-localed +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=strict -ProtectHome=yes +PrivateTmp=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any +ProtectKernelTunables=yes +ProtectSystem=strict ReadWritePaths=/etc +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +WatchdogSec=3min diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 961263f607..6b362ccdca 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -20,22 +20,22 @@ Wants=dbus.socket After=dbus.socket [Service] +BusName=org.freedesktop.login1 +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG ExecStart=@rootlibexecdir@/systemd-logind +FileDescriptorStoreMax=512 +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes Restart=always RestartSec=0 -BusName=org.freedesktop.login1 -WatchdogSec=3min -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictRealtime=yes SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any -FileDescriptorStoreMax=512 +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +WatchdogSec=3min # Increase the default a bit in order to allow many simultaneous logins since # we keep one fd open per session. diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index 1200a90a61..d90e71ae67 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -16,18 +16,18 @@ After=machine.slice RequiresMountsFor=/var/lib/machines [Service] -ExecStart=@rootlibexecdir@/systemd-machined BusName=org.freedesktop.machine1 -WatchdogSec=3min CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=@system-service @mount -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes +ExecStart=@rootlibexecdir@/systemd-machined IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +RestrictRealtime=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service @mount +WatchdogSec=3min # Note that machined cannot be placed in a mount namespace, since it # needs access to the host's mount namespace in order to implement the diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 65d3e2a660..f23bf227fb 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -19,28 +19,28 @@ Conflicts=shutdown.target Wants=network.target [Service] -Type=notify +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +ExecStart=!!@rootlibexecdir@/systemd-networkd +LockPersonality=yes +MemoryDenyWriteExecute=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectSystem=strict Restart=on-failure RestartSec=0 -ExecStart=!!@rootlibexecdir@/systemd-networkd -WatchdogSec=3min -User=systemd-network -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes +RestrictNamespaces=yes +RestrictRealtime=yes RuntimeDirectory=systemd/netif RuntimeDirectoryPreserve=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +Type=notify +User=systemd-network +WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index ef5398cbf0..d08842f0d4 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -20,31 +20,31 @@ Conflicts=shutdown.target Wants=nss-lookup.target [Service] -Type=notify +AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +ExecStart=!!@rootlibexecdir@/systemd-resolved +LockPersonality=yes +MemoryDenyWriteExecute=yes +PrivateDevices=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict Restart=always RestartSec=0 -ExecStart=!!@rootlibexecdir@/systemd-resolved -WatchdogSec=3min -User=systemd-resolve -CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -PrivateTmp=yes -PrivateDevices=yes -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes +RestrictNamespaces=yes +RestrictRealtime=yes RuntimeDirectory=systemd/resolve RuntimeDirectoryPreserve=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +Type=notify +User=systemd-resolve +WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-rfkill.service.in b/units/systemd-rfkill.service.in index 4b68f0b5a7..7447ed5b5b 100644 --- a/units/systemd-rfkill.service.in +++ b/units/systemd-rfkill.service.in @@ -17,7 +17,7 @@ After=sys-devices-virtual-misc-rfkill.device systemd-remount-fs.service Before=shutdown.target [Service] -Type=notify ExecStart=@rootlibexecdir@/systemd-rfkill -TimeoutSec=30s StateDirectory=systemd/rfkill +TimeoutSec=30s +Type=notify diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 906bb4326c..1105f1a980 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -13,23 +13,23 @@ Documentation=man:systemd-timedated.service(8) man:localtime(5) Documentation=https://www.freedesktop.org/wiki/Software/systemd/timedated [Service] -ExecStart=@rootlibexecdir@/systemd-timedated BusName=org.freedesktop.timedate1 -WatchdogSec=3min CapabilityBoundingSet=CAP_SYS_TIME -PrivateTmp=yes -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX -SystemCallFilter=@system-service @clock -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes +ExecStart=@rootlibexecdir@/systemd-timedated IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict ReadWritePaths=/etc +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service @clock +WatchdogSec=3min diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 12f918dd11..8b99e92e01 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -19,31 +19,31 @@ Conflicts=shutdown.target Wants=time-sync.target [Service] -Type=notify +AmbientCapabilities=CAP_SYS_TIME +CapabilityBoundingSet=CAP_SYS_TIME +ExecStart=!!@rootlibexecdir@/systemd-timesyncd +LockPersonality=yes +MemoryDenyWriteExecute=yes +PrivateDevices=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict Restart=always RestartSec=0 -ExecStart=!!@rootlibexecdir@/systemd-timesyncd -WatchdogSec=3min -User=systemd-timesync -CapabilityBoundingSet=CAP_SYS_TIME -AmbientCapabilities=CAP_SYS_TIME -PrivateTmp=yes -PrivateDevices=yes -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes RuntimeDirectory=systemd/timesync -SystemCallFilter=@system-service @clock -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes StateDirectory=systemd/timesync +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service @clock +Type=notify +User=systemd-timesync +WatchdogSec=3min [Install] WantedBy=sysinit.target From 64d7f7b4a15f1534fb19fda6b601fec50783bee4 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 12 Nov 2018 17:19:48 +0100 Subject: [PATCH 3/5] units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. Fixes: #1219 --- units/systemd-coredump@.service.in | 1 + units/systemd-hostnamed.service.in | 1 + units/systemd-initctl.service.in | 1 + units/systemd-journal-gatewayd.service.in | 1 + units/systemd-journal-remote.service.in | 1 + units/systemd-journal-upload.service.in | 1 + units/systemd-journald.service.in | 1 + units/systemd-localed.service.in | 1 + units/systemd-logind.service.in | 1 + units/systemd-machined.service.in | 1 + units/systemd-networkd.service.in | 1 + units/systemd-resolved.service.in | 1 + units/systemd-rfkill.service.in | 1 + units/systemd-timedated.service.in | 1 + units/systemd-timesyncd.service.in | 1 + 15 files changed, 15 insertions(+) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 74dcf7fe06..ffcb5f36ca 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -22,6 +22,7 @@ IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes Nice=9 +NoNewPrivileges=yes OOMScoreAdjust=500 PrivateDevices=yes PrivateNetwork=yes diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 696d4e2e60..9c925e80d9 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -19,6 +19,7 @@ ExecStart=@rootlibexecdir@/systemd-hostnamed IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes PrivateTmp=yes diff --git a/units/systemd-initctl.service.in b/units/systemd-initctl.service.in index f48d673d58..c276283908 100644 --- a/units/systemd-initctl.service.in +++ b/units/systemd-initctl.service.in @@ -14,5 +14,6 @@ DefaultDependencies=no [Service] ExecStart=@rootlibexecdir@/systemd-initctl +NoNewPrivileges=yes NotifyAccess=all SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index 5ef4ee0058..ebc8bf9a25 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -17,6 +17,7 @@ DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-gatewayd LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes ProtectControlGroups=yes diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index ec1311da88..29a99aaec1 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -17,6 +17,7 @@ ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/va LockPersonality=yes LogsDirectory=journal/remote MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes PrivateTmp=yes diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index a15744e1e8..92cd4e5259 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -18,6 +18,7 @@ DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes ProtectControlGroups=yes ProtectHome=yes diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 7b659d4b03..4684f095c0 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -22,6 +22,7 @@ FileDescriptorStoreMax=4224 IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes Restart=always RestartSec=0 RestrictAddressFamilies=AF_UNIX AF_NETLINK diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index 7d40fb4897..01e0703d0e 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -19,6 +19,7 @@ ExecStart=@rootlibexecdir@/systemd-localed IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes PrivateTmp=yes diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 6b362ccdca..38a7f269ac 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -27,6 +27,7 @@ FileDescriptorStoreMax=512 IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes Restart=always RestartSec=0 RestrictAddressFamilies=AF_UNIX AF_NETLINK diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index d90e71ae67..9f1476814d 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -22,6 +22,7 @@ ExecStart=@rootlibexecdir@/systemd-machined IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 RestrictRealtime=yes SystemCallArchitectures=native diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index f23bf227fb..472ef045de 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -24,6 +24,7 @@ CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_N ExecStart=!!@rootlibexecdir@/systemd-networkd LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes ProtectControlGroups=yes ProtectHome=yes ProtectKernelModules=yes diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index d08842f0d4..3144b70063 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -25,6 +25,7 @@ CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE ExecStart=!!@rootlibexecdir@/systemd-resolved LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateTmp=yes ProtectControlGroups=yes diff --git a/units/systemd-rfkill.service.in b/units/systemd-rfkill.service.in index 7447ed5b5b..3abb958310 100644 --- a/units/systemd-rfkill.service.in +++ b/units/systemd-rfkill.service.in @@ -18,6 +18,7 @@ Before=shutdown.target [Service] ExecStart=@rootlibexecdir@/systemd-rfkill +NoNewPrivileges=yes StateDirectory=systemd/rfkill TimeoutSec=30s Type=notify diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 1105f1a980..6d53024195 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -19,6 +19,7 @@ ExecStart=@rootlibexecdir@/systemd-timedated IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateTmp=yes ProtectControlGroups=yes ProtectHome=yes diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 8b99e92e01..03ade45d08 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -24,6 +24,7 @@ CapabilityBoundingSet=CAP_SYS_TIME ExecStart=!!@rootlibexecdir@/systemd-timesyncd LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateTmp=yes ProtectControlGroups=yes From e68a35a78d736ac0bb6609a130f87546e6d48ab1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 18 Dec 2018 14:14:44 +0100 Subject: [PATCH 4/5] NEWS: add note about NNP=yes --- NEWS | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS b/NEWS index a9ba9e13fd..1bb8a13862 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,13 @@ systemd System and Service Manager CHANGES WITH 240 in spe: + * NoNewPrivileges=yes has been set for all long-running services + implemented by systemd. Previously, this was problematic due to + SELinux (as this would also prohibit the transition from PID1's label + to the service's label). This restriction has since been lifted, but + an SELinux policy update is required. + (See e.g. https://github.com/fedora-selinux/selinux-policy/pull/234.) + * A new service type has been added: Type=exec. It's very similar to Type=simple but ensures the service manager will wait for both fork() and execve() of the main service binary to complete before proceeding From b1a082cd91da2adb0088461f7821db38831ea9bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 18 Dec 2018 14:31:24 +0100 Subject: [PATCH 5/5] NEWS: add a note about symlink following in .wants and .requires This ain't so easy to express without using too much technical language... https://github.com/systemd/systemd/pull/10094#issuecomment-427407570 --- NEWS | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/NEWS b/NEWS index 1bb8a13862..8d7d9c7d56 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,19 @@ CHANGES WITH 240 in spe: an SELinux policy update is required. (See e.g. https://github.com/fedora-selinux/selinux-policy/pull/234.) + * When unit files are loaded from disk, previously systemd would + sometimes (depending on the unit loading order) load units from the + target path of symlinks in .wants/ or .requires/ directories of other + units. This meant that unit could be loaded from different paths + depending on whether the unit was requested explicitly or as a + dependency of another unit, not honouring the priority of directories + in search path. It also meant that it was possible to successfully + load and start units which are not found in the unit search path, as + long as they were requested as a dependency and linked to from + .wants/ or .requires/. The target paths of those symlinks are not + used for loading units anymore and the unit file must be found in + the search path. + * A new service type has been added: Type=exec. It's very similar to Type=simple but ensures the service manager will wait for both fork() and execve() of the main service binary to complete before proceeding