From 04c65645fa33a08aed5aaa0981eeed9957a206fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 18 Dec 2018 14:02:56 +0100 Subject: [PATCH 1/5] Revert "units: set NoNewPrivileges= for all long-running services" This reverts commit 3ca9940cb95cb263c6bfe5cfee72df232fe46a94. Let's split the commit in two: the sorting and the changes. Because there's a requirement to update selinux policy, this change is incompatible, strictly speaking. I expect that distributions might want to revert this particular change. Let's make it easy. --- units/systemd-coredump@.service.in | 29 +++++++-------- units/systemd-hostnamed.service.in | 33 ++++++++--------- units/systemd-initctl.service.in | 3 +- units/systemd-journal-gatewayd.service.in | 19 +++++----- units/systemd-journal-remote.service.in | 31 ++++++++-------- units/systemd-journal-upload.service.in | 29 +++++++-------- units/systemd-journald.service.in | 27 +++++++------- units/systemd-localed.service.in | 33 ++++++++--------- units/systemd-logind.service.in | 25 ++++++------- units/systemd-machined.service.in | 21 +++++------ units/systemd-networkd.service.in | 35 +++++++++--------- units/systemd-resolved.service.in | 41 ++++++++++----------- units/systemd-rfkill.service.in | 7 ++-- units/systemd-timedated.service.in | 37 +++++++++---------- units/systemd-timesyncd.service.in | 45 +++++++++++------------ 15 files changed, 200 insertions(+), 215 deletions(-) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index ffcb5f36ca6..215696ecd1e 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -18,25 +18,24 @@ Before=shutdown.target [Service] ExecStart=-@rootlibexecdir@/systemd-coredump -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes Nice=9 -NoNewPrivileges=yes OOMScoreAdjust=500 +RuntimeMaxSec=5min +PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes ProtectSystem=strict -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -RuntimeMaxSec=5min -StateDirectory=systemd/coredump -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +StateDirectory=systemd/coredump diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 9c925e80d9f..da74b4fe8b2 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -13,26 +13,25 @@ Documentation=man:systemd-hostnamed.service(8) man:hostname(5) man:machine-info( Documentation=https://www.freedesktop.org/wiki/Software/systemd/hostnamed [Service] -BusName=org.freedesktop.hostname1 -CapabilityBoundingSet=CAP_SYS_ADMIN ExecStart=@rootlibexecdir@/systemd-hostnamed -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes +BusName=org.freedesktop.hostname1 +WatchdogSec=3min +CapabilityBoundingSet=CAP_SYS_ADMIN +PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes ProtectSystem=strict -ReadWritePaths=/etc -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX SystemCallFilter=@system-service sethostname -WatchdogSec=3min +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +ReadWritePaths=/etc diff --git a/units/systemd-initctl.service.in b/units/systemd-initctl.service.in index c2762839084..2b4b957dce3 100644 --- a/units/systemd-initctl.service.in +++ b/units/systemd-initctl.service.in @@ -13,7 +13,6 @@ Documentation=man:systemd-initctl.service(8) DefaultDependencies=no [Service] -ExecStart=@rootlibexecdir@/systemd-initctl -NoNewPrivileges=yes NotifyAccess=all +ExecStart=@rootlibexecdir@/systemd-initctl SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index ebc8bf9a254..a51d59d1011 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -13,23 +13,22 @@ Documentation=man:systemd-journal-gatewayd(8) Requires=systemd-journal-gatewayd.socket [Service] -DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-gatewayd -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes +User=systemd-journal-gateway +SupplementaryGroups=systemd-journal +DynamicUser=yes PrivateDevices=yes PrivateNetwork=yes -ProtectControlGroups=yes ProtectHome=yes -ProtectKernelModules=yes +ProtectControlGroups=yes ProtectKernelTunables=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -SupplementaryGroups=systemd-journal +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native -User=systemd-journal-gateway +LockPersonality=yes # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index 29a99aaec1a..fa8682cd285 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -14,24 +14,23 @@ Requires=systemd-journal-remote.socket [Service] ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/ -LockPersonality=yes -LogsDirectory=journal/remote -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -SystemCallArchitectures=native User=systemd-journal-remote WatchdogSec=3min +PrivateTmp=yes +PrivateDevices=yes +PrivateNetwork=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +SystemCallArchitectures=native +LockPersonality=yes +LogsDirectory=journal/remote # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index 92cd4e52592..1ded9908779 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -14,24 +14,23 @@ Wants=network-online.target After=network-online.target [Service] -DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -StateDirectory=systemd/journal-upload -SupplementaryGroups=systemd-journal -SystemCallArchitectures=native User=systemd-journal-upload +DynamicUser=yes +SupplementaryGroups=systemd-journal WatchdogSec=3min +PrivateDevices=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +SystemCallArchitectures=native +LockPersonality=yes +StateDirectory=systemd/journal-upload # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 4684f095c07..41cac8cf656 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -16,25 +16,24 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a Before=sysinit.target [Service] -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE +Type=notify +Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket ExecStart=@rootlibexecdir@/systemd-journald -FileDescriptorStoreMax=4224 -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket StandardOutput=null -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service -Type=notify WatchdogSec=3min +FileDescriptorStoreMax=4224 +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index 01e0703d0e2..a24e61a0cdd 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -13,26 +13,25 @@ Documentation=man:systemd-localed.service(8) man:locale.conf(5) man:vconsole.con Documentation=https://www.freedesktop.org/wiki/Software/systemd/localed [Service] -BusName=org.freedesktop.locale1 -CapabilityBoundingSet= ExecStart=@rootlibexecdir@/systemd-localed -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes +BusName=org.freedesktop.locale1 +WatchdogSec=3min +CapabilityBoundingSet= +PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes ProtectSystem=strict -ReadWritePaths=/etc -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX SystemCallFilter=@system-service -WatchdogSec=3min +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +ReadWritePaths=/etc diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 38a7f269aca..961263f6071 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -20,23 +20,22 @@ Wants=dbus.socket After=dbus.socket [Service] -BusName=org.freedesktop.login1 -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG ExecStart=@rootlibexecdir@/systemd-logind -FileDescriptorStoreMax=512 -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service +BusName=org.freedesktop.login1 WatchdogSec=3min +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +FileDescriptorStoreMax=512 # Increase the default a bit in order to allow many simultaneous logins since # we keep one fd open per session. diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index 9f1476814df..1200a90a61a 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -16,19 +16,18 @@ After=machine.slice RequiresMountsFor=/var/lib/machines [Service] -BusName=org.freedesktop.machine1 -CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD ExecStart=@rootlibexecdir@/systemd-machined -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service @mount +BusName=org.freedesktop.machine1 WatchdogSec=3min +CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +SystemCallFilter=@system-service @mount +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any # Note that machined cannot be placed in a mount namespace, since it # needs access to the host's mount namespace in order to implement the diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 472ef045de9..65d3e2a6604 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -19,29 +19,28 @@ Conflicts=shutdown.target Wants=network.target [Service] -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -ExecStart=!!@rootlibexecdir@/systemd-networkd -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectSystem=strict +Type=notify Restart=on-failure RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET -RestrictNamespaces=yes +ExecStart=!!@rootlibexecdir@/systemd-networkd +WatchdogSec=3min +User=systemd-network +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes RuntimeDirectory=systemd/netif RuntimeDirectoryPreserve=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service -Type=notify -User=systemd-network -WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index 3144b70063e..ef5398cbf07 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -20,32 +20,31 @@ Conflicts=shutdown.target Wants=nss-lookup.target [Service] -AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -ExecStart=!!@rootlibexecdir@/systemd-resolved -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict +Type=notify Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -RestrictNamespaces=yes +ExecStart=!!@rootlibexecdir@/systemd-resolved +WatchdogSec=3min +User=systemd-resolve +CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes RuntimeDirectory=systemd/resolve RuntimeDirectoryPreserve=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service -Type=notify -User=systemd-resolve -WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-rfkill.service.in b/units/systemd-rfkill.service.in index 3abb958310d..4b68f0b5a77 100644 --- a/units/systemd-rfkill.service.in +++ b/units/systemd-rfkill.service.in @@ -17,8 +17,7 @@ After=sys-devices-virtual-misc-rfkill.device systemd-remount-fs.service Before=shutdown.target [Service] -ExecStart=@rootlibexecdir@/systemd-rfkill -NoNewPrivileges=yes -StateDirectory=systemd/rfkill -TimeoutSec=30s Type=notify +ExecStart=@rootlibexecdir@/systemd-rfkill +TimeoutSec=30s +StateDirectory=systemd/rfkill diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 6d530241957..906bb4326ca 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -13,24 +13,23 @@ Documentation=man:systemd-timedated.service(8) man:localtime(5) Documentation=https://www.freedesktop.org/wiki/Software/systemd/timedated [Service] -BusName=org.freedesktop.timedate1 -CapabilityBoundingSet=CAP_SYS_TIME ExecStart=@rootlibexecdir@/systemd-timedated -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict -ReadWritePaths=/etc -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes -RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service @clock +BusName=org.freedesktop.timedate1 WatchdogSec=3min +CapabilityBoundingSet=CAP_SYS_TIME +PrivateTmp=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX +SystemCallFilter=@system-service @clock +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +ReadWritePaths=/etc diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 03ade45d086..12f918dd11b 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -19,32 +19,31 @@ Conflicts=shutdown.target Wants=time-sync.target [Service] -AmbientCapabilities=CAP_SYS_TIME -CapabilityBoundingSet=CAP_SYS_TIME -ExecStart=!!@rootlibexecdir@/systemd-timesyncd -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict +Type=notify Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -RuntimeDirectory=systemd/timesync -StateDirectory=systemd/timesync -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service @clock -Type=notify -User=systemd-timesync +ExecStart=!!@rootlibexecdir@/systemd-timesyncd WatchdogSec=3min +User=systemd-timesync +CapabilityBoundingSet=CAP_SYS_TIME +AmbientCapabilities=CAP_SYS_TIME +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RuntimeDirectory=systemd/timesync +SystemCallFilter=@system-service @clock +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +StateDirectory=systemd/timesync [Install] WantedBy=sysinit.target From 52ef7bbbe653aaecffdf49b54af148993f4db46b Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 18 Dec 2018 14:07:23 +0100 Subject: [PATCH 2/5] units: sort [Service] sections alphabetically --- units/systemd-coredump@.service.in | 26 +++++++-------- units/systemd-hostnamed.service.in | 30 ++++++++--------- units/systemd-initctl.service.in | 2 +- units/systemd-journal-gatewayd.service.in | 18 +++++----- units/systemd-journal-remote.service.in | 30 ++++++++--------- units/systemd-journal-upload.service.in | 28 ++++++++-------- units/systemd-journald.service.in | 26 +++++++-------- units/systemd-localed.service.in | 30 ++++++++--------- units/systemd-logind.service.in | 22 ++++++------- units/systemd-machined.service.in | 18 +++++----- units/systemd-networkd.service.in | 34 +++++++++---------- units/systemd-resolved.service.in | 40 +++++++++++------------ units/systemd-rfkill.service.in | 4 +-- units/systemd-timedated.service.in | 32 +++++++++--------- units/systemd-timesyncd.service.in | 40 +++++++++++------------ 15 files changed, 190 insertions(+), 190 deletions(-) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 215696ecd1e..74dcf7fe06b 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -18,24 +18,24 @@ Before=shutdown.target [Service] ExecStart=-@rootlibexecdir@/systemd-coredump +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes Nice=9 OOMScoreAdjust=500 -RuntimeMaxSec=5min -PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=strict -ProtectHome=yes +PrivateTmp=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes +ProtectKernelTunables=yes +ProtectSystem=strict RestrictAddressFamilies=AF_UNIX -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any +RestrictNamespaces=yes +RestrictRealtime=yes +RuntimeMaxSec=5min StateDirectory=systemd/coredump +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index da74b4fe8b2..696d4e2e60f 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -13,25 +13,25 @@ Documentation=man:systemd-hostnamed.service(8) man:hostname(5) man:machine-info( Documentation=https://www.freedesktop.org/wiki/Software/systemd/hostnamed [Service] -ExecStart=@rootlibexecdir@/systemd-hostnamed BusName=org.freedesktop.hostname1 -WatchdogSec=3min CapabilityBoundingSet=CAP_SYS_ADMIN -PrivateTmp=yes +ExecStart=@rootlibexecdir@/systemd-hostnamed +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=strict -ProtectHome=yes +PrivateTmp=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX -SystemCallFilter=@system-service sethostname -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any +ProtectKernelTunables=yes +ProtectSystem=strict ReadWritePaths=/etc +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service sethostname +WatchdogSec=3min diff --git a/units/systemd-initctl.service.in b/units/systemd-initctl.service.in index 2b4b957dce3..f48d673d587 100644 --- a/units/systemd-initctl.service.in +++ b/units/systemd-initctl.service.in @@ -13,6 +13,6 @@ Documentation=man:systemd-initctl.service(8) DefaultDependencies=no [Service] -NotifyAccess=all ExecStart=@rootlibexecdir@/systemd-initctl +NotifyAccess=all SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index a51d59d1011..5ef4ee0058c 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -13,22 +13,22 @@ Documentation=man:systemd-journal-gatewayd(8) Requires=systemd-journal-gatewayd.socket [Service] -ExecStart=@rootlibexecdir@/systemd-journal-gatewayd -User=systemd-journal-gateway -SupplementaryGroups=systemd-journal DynamicUser=yes +ExecStart=@rootlibexecdir@/systemd-journal-gatewayd +LockPersonality=yes +MemoryDenyWriteExecute=yes PrivateDevices=yes PrivateNetwork=yes -ProtectHome=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes +ProtectKernelTunables=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +SupplementaryGroups=systemd-journal SystemCallArchitectures=native -LockPersonality=yes +User=systemd-journal-gateway # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index fa8682cd285..ec1311da88e 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -14,23 +14,23 @@ Requires=systemd-journal-remote.socket [Service] ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/ -User=systemd-journal-remote -WatchdogSec=3min -PrivateTmp=yes -PrivateDevices=yes -PrivateNetwork=yes -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -SystemCallArchitectures=native LockPersonality=yes LogsDirectory=journal/remote +MemoryDenyWriteExecute=yes +PrivateDevices=yes +PrivateNetwork=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +SystemCallArchitectures=native +User=systemd-journal-remote +WatchdogSec=3min # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index 1ded9908779..a15744e1e8f 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -14,23 +14,23 @@ Wants=network-online.target After=network-online.target [Service] -ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state -User=systemd-journal-upload DynamicUser=yes -SupplementaryGroups=systemd-journal -WatchdogSec=3min -PrivateDevices=yes -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -SystemCallArchitectures=native +ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state LockPersonality=yes +MemoryDenyWriteExecute=yes +PrivateDevices=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes StateDirectory=systemd/journal-upload +SupplementaryGroups=systemd-journal +SystemCallArchitectures=native +User=systemd-journal-upload +WatchdogSec=3min # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 41cac8cf656..7b659d4b03c 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -16,24 +16,24 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a Before=sysinit.target [Service] -Type=notify -Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE ExecStart=@rootlibexecdir@/systemd-journald +FileDescriptorStoreMax=4224 +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes Restart=always RestartSec=0 -StandardOutput=null -WatchdogSec=3min -FileDescriptorStoreMax=4224 -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictRealtime=yes +Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket +StandardOutput=null SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +Type=notify +WatchdogSec=3min # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index a24e61a0cdd..7d40fb4897d 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -13,25 +13,25 @@ Documentation=man:systemd-localed.service(8) man:locale.conf(5) man:vconsole.con Documentation=https://www.freedesktop.org/wiki/Software/systemd/localed [Service] -ExecStart=@rootlibexecdir@/systemd-localed BusName=org.freedesktop.locale1 -WatchdogSec=3min CapabilityBoundingSet= -PrivateTmp=yes +ExecStart=@rootlibexecdir@/systemd-localed +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=strict -ProtectHome=yes +PrivateTmp=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any +ProtectKernelTunables=yes +ProtectSystem=strict ReadWritePaths=/etc +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +WatchdogSec=3min diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 961263f6071..6b362ccdca6 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -20,22 +20,22 @@ Wants=dbus.socket After=dbus.socket [Service] +BusName=org.freedesktop.login1 +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG ExecStart=@rootlibexecdir@/systemd-logind +FileDescriptorStoreMax=512 +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes Restart=always RestartSec=0 -BusName=org.freedesktop.login1 -WatchdogSec=3min -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictRealtime=yes SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any -FileDescriptorStoreMax=512 +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +WatchdogSec=3min # Increase the default a bit in order to allow many simultaneous logins since # we keep one fd open per session. diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index 1200a90a61a..d90e71ae676 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -16,18 +16,18 @@ After=machine.slice RequiresMountsFor=/var/lib/machines [Service] -ExecStart=@rootlibexecdir@/systemd-machined BusName=org.freedesktop.machine1 -WatchdogSec=3min CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=@system-service @mount -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes +ExecStart=@rootlibexecdir@/systemd-machined IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +RestrictRealtime=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service @mount +WatchdogSec=3min # Note that machined cannot be placed in a mount namespace, since it # needs access to the host's mount namespace in order to implement the diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 65d3e2a6604..f23bf227fb6 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -19,28 +19,28 @@ Conflicts=shutdown.target Wants=network.target [Service] -Type=notify +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +ExecStart=!!@rootlibexecdir@/systemd-networkd +LockPersonality=yes +MemoryDenyWriteExecute=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectSystem=strict Restart=on-failure RestartSec=0 -ExecStart=!!@rootlibexecdir@/systemd-networkd -WatchdogSec=3min -User=systemd-network -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes +RestrictNamespaces=yes +RestrictRealtime=yes RuntimeDirectory=systemd/netif RuntimeDirectoryPreserve=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +Type=notify +User=systemd-network +WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index ef5398cbf07..d08842f0d43 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -20,31 +20,31 @@ Conflicts=shutdown.target Wants=nss-lookup.target [Service] -Type=notify +AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +ExecStart=!!@rootlibexecdir@/systemd-resolved +LockPersonality=yes +MemoryDenyWriteExecute=yes +PrivateDevices=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict Restart=always RestartSec=0 -ExecStart=!!@rootlibexecdir@/systemd-resolved -WatchdogSec=3min -User=systemd-resolve -CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -PrivateTmp=yes -PrivateDevices=yes -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes +RestrictNamespaces=yes +RestrictRealtime=yes RuntimeDirectory=systemd/resolve RuntimeDirectoryPreserve=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +Type=notify +User=systemd-resolve +WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-rfkill.service.in b/units/systemd-rfkill.service.in index 4b68f0b5a77..7447ed5b5bf 100644 --- a/units/systemd-rfkill.service.in +++ b/units/systemd-rfkill.service.in @@ -17,7 +17,7 @@ After=sys-devices-virtual-misc-rfkill.device systemd-remount-fs.service Before=shutdown.target [Service] -Type=notify ExecStart=@rootlibexecdir@/systemd-rfkill -TimeoutSec=30s StateDirectory=systemd/rfkill +TimeoutSec=30s +Type=notify diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 906bb4326ca..1105f1a9804 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -13,23 +13,23 @@ Documentation=man:systemd-timedated.service(8) man:localtime(5) Documentation=https://www.freedesktop.org/wiki/Software/systemd/timedated [Service] -ExecStart=@rootlibexecdir@/systemd-timedated BusName=org.freedesktop.timedate1 -WatchdogSec=3min CapabilityBoundingSet=CAP_SYS_TIME -PrivateTmp=yes -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes -RestrictAddressFamilies=AF_UNIX -SystemCallFilter=@system-service @clock -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes +ExecStart=@rootlibexecdir@/systemd-timedated IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict ReadWritePaths=/etc +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service @clock +WatchdogSec=3min diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 12f918dd11b..8b99e92e017 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -19,31 +19,31 @@ Conflicts=shutdown.target Wants=time-sync.target [Service] -Type=notify +AmbientCapabilities=CAP_SYS_TIME +CapabilityBoundingSet=CAP_SYS_TIME +ExecStart=!!@rootlibexecdir@/systemd-timesyncd +LockPersonality=yes +MemoryDenyWriteExecute=yes +PrivateDevices=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict Restart=always RestartSec=0 -ExecStart=!!@rootlibexecdir@/systemd-timesyncd -WatchdogSec=3min -User=systemd-timesync -CapabilityBoundingSet=CAP_SYS_TIME -AmbientCapabilities=CAP_SYS_TIME -PrivateTmp=yes -PrivateDevices=yes -ProtectSystem=strict -ProtectHome=yes -ProtectControlGroups=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes RuntimeDirectory=systemd/timesync -SystemCallFilter=@system-service @clock -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes StateDirectory=systemd/timesync +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service @clock +Type=notify +User=systemd-timesync +WatchdogSec=3min [Install] WantedBy=sysinit.target From 64d7f7b4a15f1534fb19fda6b601fec50783bee4 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 12 Nov 2018 17:19:48 +0100 Subject: [PATCH 3/5] units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. Fixes: #1219 --- units/systemd-coredump@.service.in | 1 + units/systemd-hostnamed.service.in | 1 + units/systemd-initctl.service.in | 1 + units/systemd-journal-gatewayd.service.in | 1 + units/systemd-journal-remote.service.in | 1 + units/systemd-journal-upload.service.in | 1 + units/systemd-journald.service.in | 1 + units/systemd-localed.service.in | 1 + units/systemd-logind.service.in | 1 + units/systemd-machined.service.in | 1 + units/systemd-networkd.service.in | 1 + units/systemd-resolved.service.in | 1 + units/systemd-rfkill.service.in | 1 + units/systemd-timedated.service.in | 1 + units/systemd-timesyncd.service.in | 1 + 15 files changed, 15 insertions(+) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 74dcf7fe06b..ffcb5f36ca6 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -22,6 +22,7 @@ IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes Nice=9 +NoNewPrivileges=yes OOMScoreAdjust=500 PrivateDevices=yes PrivateNetwork=yes diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 696d4e2e60f..9c925e80d9f 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -19,6 +19,7 @@ ExecStart=@rootlibexecdir@/systemd-hostnamed IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes PrivateTmp=yes diff --git a/units/systemd-initctl.service.in b/units/systemd-initctl.service.in index f48d673d587..c2762839084 100644 --- a/units/systemd-initctl.service.in +++ b/units/systemd-initctl.service.in @@ -14,5 +14,6 @@ DefaultDependencies=no [Service] ExecStart=@rootlibexecdir@/systemd-initctl +NoNewPrivileges=yes NotifyAccess=all SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index 5ef4ee0058c..ebc8bf9a254 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -17,6 +17,7 @@ DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-gatewayd LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes ProtectControlGroups=yes diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index ec1311da88e..29a99aaec1a 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -17,6 +17,7 @@ ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/va LockPersonality=yes LogsDirectory=journal/remote MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes PrivateTmp=yes diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index a15744e1e8f..92cd4e52592 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -18,6 +18,7 @@ DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes ProtectControlGroups=yes ProtectHome=yes diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 7b659d4b03c..4684f095c07 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -22,6 +22,7 @@ FileDescriptorStoreMax=4224 IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes Restart=always RestartSec=0 RestrictAddressFamilies=AF_UNIX AF_NETLINK diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index 7d40fb4897d..01e0703d0e2 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -19,6 +19,7 @@ ExecStart=@rootlibexecdir@/systemd-localed IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes PrivateTmp=yes diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 6b362ccdca6..38a7f269aca 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -27,6 +27,7 @@ FileDescriptorStoreMax=512 IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes Restart=always RestartSec=0 RestrictAddressFamilies=AF_UNIX AF_NETLINK diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index d90e71ae676..9f1476814df 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -22,6 +22,7 @@ ExecStart=@rootlibexecdir@/systemd-machined IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 RestrictRealtime=yes SystemCallArchitectures=native diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index f23bf227fb6..472ef045de9 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -24,6 +24,7 @@ CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_N ExecStart=!!@rootlibexecdir@/systemd-networkd LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes ProtectControlGroups=yes ProtectHome=yes ProtectKernelModules=yes diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index d08842f0d43..3144b70063e 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -25,6 +25,7 @@ CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE ExecStart=!!@rootlibexecdir@/systemd-resolved LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateTmp=yes ProtectControlGroups=yes diff --git a/units/systemd-rfkill.service.in b/units/systemd-rfkill.service.in index 7447ed5b5bf..3abb958310d 100644 --- a/units/systemd-rfkill.service.in +++ b/units/systemd-rfkill.service.in @@ -18,6 +18,7 @@ Before=shutdown.target [Service] ExecStart=@rootlibexecdir@/systemd-rfkill +NoNewPrivileges=yes StateDirectory=systemd/rfkill TimeoutSec=30s Type=notify diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 1105f1a9804..6d530241957 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -19,6 +19,7 @@ ExecStart=@rootlibexecdir@/systemd-timedated IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateTmp=yes ProtectControlGroups=yes ProtectHome=yes diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 8b99e92e017..03ade45d086 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -24,6 +24,7 @@ CapabilityBoundingSet=CAP_SYS_TIME ExecStart=!!@rootlibexecdir@/systemd-timesyncd LockPersonality=yes MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateTmp=yes ProtectControlGroups=yes From e68a35a78d736ac0bb6609a130f87546e6d48ab1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 18 Dec 2018 14:14:44 +0100 Subject: [PATCH 4/5] NEWS: add note about NNP=yes --- NEWS | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS b/NEWS index a9ba9e13fd5..1bb8a138621 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,13 @@ systemd System and Service Manager CHANGES WITH 240 in spe: + * NoNewPrivileges=yes has been set for all long-running services + implemented by systemd. Previously, this was problematic due to + SELinux (as this would also prohibit the transition from PID1's label + to the service's label). This restriction has since been lifted, but + an SELinux policy update is required. + (See e.g. https://github.com/fedora-selinux/selinux-policy/pull/234.) + * A new service type has been added: Type=exec. It's very similar to Type=simple but ensures the service manager will wait for both fork() and execve() of the main service binary to complete before proceeding From b1a082cd91da2adb0088461f7821db38831ea9bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 18 Dec 2018 14:31:24 +0100 Subject: [PATCH 5/5] NEWS: add a note about symlink following in .wants and .requires This ain't so easy to express without using too much technical language... https://github.com/systemd/systemd/pull/10094#issuecomment-427407570 --- NEWS | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/NEWS b/NEWS index 1bb8a138621..8d7d9c7d56f 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,19 @@ CHANGES WITH 240 in spe: an SELinux policy update is required. (See e.g. https://github.com/fedora-selinux/selinux-policy/pull/234.) + * When unit files are loaded from disk, previously systemd would + sometimes (depending on the unit loading order) load units from the + target path of symlinks in .wants/ or .requires/ directories of other + units. This meant that unit could be loaded from different paths + depending on whether the unit was requested explicitly or as a + dependency of another unit, not honouring the priority of directories + in search path. It also meant that it was possible to successfully + load and start units which are not found in the unit search path, as + long as they were requested as a dependency and linked to from + .wants/ or .requires/. The target paths of those symlinks are not + used for loading units anymore and the unit file must be found in + the search path. + * A new service type has been added: Type=exec. It's very similar to Type=simple but ensures the service manager will wait for both fork() and execve() of the main service binary to complete before proceeding