Merge pull request 'Add no_new_privs hardening to OpenRC and systemd service files' (#575) from norm/akkoma:no-new-privs into develop

Reviewed-on: AkkomaGang/akkoma#575
This commit is contained in:
floatingghost 2023-07-27 12:54:44 +00:00
commit 597a97cca9
4 changed files with 8 additions and 0 deletions

View file

@ -17,6 +17,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
- Deactivated users can no longer show up in the emoji reaction list - Deactivated users can no longer show up in the emoji reaction list
- Embedded posts can no longer bypass `:restrict\_unauthenticated` - Embedded posts can no longer bypass `:restrict\_unauthenticated`
## Security
- Add `no_new_privs` hardening to OpenRC and systemd service files
## 2023.05 ## 2023.05
## Added ## Added

View file

@ -38,6 +38,8 @@ ProtectHome=true
ProtectSystem=full ProtectSystem=full
; Sets up a new /dev mount for the process and only adds API pseudo devices like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled by default because it may not work on devices like the Raspberry Pi. ; Sets up a new /dev mount for the process and only adds API pseudo devices like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled by default because it may not work on devices like the Raspberry Pi.
PrivateDevices=false PrivateDevices=false
; Ensures that the service process and all its children can never gain new privileges through execve().
NoNewPrivileges=true
; Drops the sysadmin capability from the daemon. ; Drops the sysadmin capability from the daemon.
CapabilityBoundingSet=~CAP_SYS_ADMIN CapabilityBoundingSet=~CAP_SYS_ADMIN

View file

@ -8,6 +8,7 @@ pidfile="/var/run/akkoma.pid"
directory=/opt/akkoma directory=/opt/akkoma
healthcheck_delay=60 healthcheck_delay=60
healthcheck_timer=30 healthcheck_timer=30
no_new_privs="yes"
: ${akkoma_port:-4000} : ${akkoma_port:-4000}

View file

@ -9,6 +9,7 @@ command=/opt/akkoma/bin/pleroma
command_args="start" command_args="start"
command_user=akkoma command_user=akkoma
command_background=1 command_background=1
no_new_privs="yes"
# Ask process to terminate within 30 seconds, otherwise kill it # Ask process to terminate within 30 seconds, otherwise kill it
retry="SIGTERM/30/SIGKILL/5" retry="SIGTERM/30/SIGKILL/5"