mirror of
https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git
synced 2025-12-26 06:30:08 +01:00
2dd3466a78
This adds some low-hanging food to improve our score with "systemd-analyze security" by one point: Before: → Overall exposure level for NetworkManager.service: 7.8 EXPOSED 🙁 After: → Overall exposure level for NetworkManager.service: 6.8 MEDIUM 😐 Nothing particularly impactful here: we still got DAC_OVERRIDE, we still can insert loadable modules (as opposed to relying on autoload) and read user home directories. But there's a slight chance this may save our butts one day, who knows. https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2062
48 lines
1.5 KiB
SYSTEMD
48 lines
1.5 KiB
SYSTEMD
[Unit]
|
|
Description=Network Manager
|
|
Documentation=man:NetworkManager(8)
|
|
Wants=network.target
|
|
After=network-pre.target dbus.service
|
|
Before=network.target @DISTRO_NETWORK_SERVICE@
|
|
BindsTo=dbus.service
|
|
|
|
[Service]
|
|
Type=dbus
|
|
BusName=org.freedesktop.NetworkManager
|
|
ExecReload=/usr/bin/busctl call org.freedesktop.NetworkManager /org/freedesktop/NetworkManager org.freedesktop.NetworkManager Reload u 0
|
|
#ExecReload=/bin/kill -HUP $MAINPID
|
|
ExecStart=@sbindir@/NetworkManager --no-daemon
|
|
Restart=on-failure
|
|
# NM doesn't want systemd to kill its children for it
|
|
KillMode=process
|
|
|
|
# With a huge number of interfaces, starting can take a long time.
|
|
TimeoutStartSec=600
|
|
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT
|
|
|
|
PrivateTmp=true
|
|
|
|
ProtectClock=true
|
|
ProtectControlGroups=true
|
|
ProtectHome=read-only
|
|
ProtectKernelLogs=true
|
|
ProtectSystem=true
|
|
|
|
RestrictNamespaces=cgroup ipc net mnt pid user uts
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
|
|
# We require file descriptors for DHCP etc. When activating many interfaces,
|
|
# the default limit of 1024 is easily reached.
|
|
LimitNOFILE=65536
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
Also=NetworkManager-dispatcher.service
|
|
|
|
# We want to enable NetworkManager-wait-online.service whenever this service
|
|
# is enabled. NetworkManager-wait-online.service has
|
|
# WantedBy=network-online.target, so enabling it only has an effect if
|
|
# network-online.target itself is enabled or pulled in by some other unit.
|
|
Also=NetworkManager-wait-online.service
|