mirror of
https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git
synced 2025-12-25 20:00:09 +01:00
ff816dec17
"nm-cloud-setup" is supposed to work without configuration. However, it (obviously) fetches data from the network you are connected to (which might be untrusted or controlled by somebody malicious). The tool cannot protect you against that, also because the meta data services uses HTTP and not HTTPS. It means, you should run the tool only when it's suitable for your environment, that is: in the right cloud. Usually, the user/admin/distributor would know for which cloud the enable the tool. It's also wasteful to repeatedly probe for the unavailable cloud. So, instead disable all providers by default and require to opt-in by setting an environment variable. This can be conveniently done via `systemctl edit nm-cloud-provider.service` to set Environment=. Of course, a image can also pre-deploy such am override file.
36 lines
841 B
SYSTEMD
36 lines
841 B
SYSTEMD
[Unit]
|
|
Description=Automatically configure NetworkManager in cloud
|
|
After=NetworkManager.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=@libexecdir@/nm-cloud-setup
|
|
|
|
#Environment=NM_CLOUD_SETUP_LOG=TRACE
|
|
|
|
# Cloud providers are disabled by default. You need to
|
|
# Opt-in by setting the right environment variable for
|
|
# the provider.
|
|
#Environment=NM_CLOUD_SETUP_EC2=yes
|
|
|
|
CapabilityBoundingSet=
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectSystem=strict
|
|
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
SystemCallFilter=@system-service
|
|
|
|
[Install]
|
|
WantedBy=NetworkManager.service
|