fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2025-12-20 09:20:04 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

cloud-setup: more sandboxing in service file

Browse source 
Note that some of those sandboxing options may require relatively
recent systemd. In that case, to run against older systemd, you
will need to patch the service file. I don't think there is
a way around that, and limiting outselves to only the oldest supported
option is harmful for users who run recent systemd.

See-also: https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening
This commit is contained in:
Thomas Haller 2023-11-22 11:11:15 +01:00
parent b4340fd9a2
commit 6fb4af7300
No known key found for this signature in database
GPG key ID: 29C2366E4DFC5728
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -22,6 +22,7 @@ Overview of changes since NetworkManager-1.44
* Limit number of exported IP addresses/routes on D-Bus to 100 to reduce * Limit number of exported IP addresses/routes on D-Bus to 100 to reduce
performance cost. Also, D-Bus updates for addresses/routes are now rate performance cost. Also, D-Bus updates for addresses/routes are now rate
limited to 3 per second. limited to 3 per second.
* cloud-setup: enable more sandboxing options in systemd service file.
============================================= =============================================
NetworkManager-1.44 NetworkManager-1.44

10
src/nm-cloud-setup/nm-cloud-setup.service.in
View file

@ -22,22 +22,30 @@ ExecStart=@libexecdir@/nm-cloud-setup
#Environment=NM_CLOUD_SETUP_ALIYUN=yes #Environment=NM_CLOUD_SETUP_ALIYUN=yes
CapabilityBoundingSet= CapabilityBoundingSet=
KeyringMode=private
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
NoNewPrivileges=yes NoNewPrivileges=yes
PrivateDevices=yes PrivateDevices=yes
PrivateTmp=yes PrivateTmp=yes
PrivateUsers=yes
ProtectClock=yes
ProtectControlGroups=yes ProtectControlGroups=yes
ProtectHome=yes ProtectHome=yes
ProtectHostname=yes ProtectHostname=yes
ProtectKernelLogs=yes ProtectKernelLogs=yes
ProtectKernelModules=yes ProtectKernelModules=yes
ProtectKernelTunables=yes ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
RestrictNamespaces=yes RestrictNamespaces=yes
RestrictRealtime=yes RestrictRealtime=yes
RestrictSUIDSGID=yes RestrictSUIDSGID=yes
SystemCallArchitectures=native
DevicePolicy=closed
PrivateNetwork=no
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
SystemCallFilter=@system-service SystemCallFilter=@system-service
[Install] [Install]