From a9ff5c830951eead9c4cfa04532d378220ccd8e4 Mon Sep 17 00:00:00 2001 From: Yurii Izorkin Date: Mon, 25 Oct 2021 17:31:20 +0300 Subject: [PATCH] templates/systemd/mastodon: update sandbox mode (#16235) * templates/systemd/mastodon: add new sandboxing options * templates/systemd/mastodon: add '@privileged' and remove duplicates SystemCallFilters * templates/systemd/mastodon: add '@ipc' SystemCallFilter * templates/systemd/mastodon: add '@memlock' SystemCallFilter * templates/systemd/mastodon: allow '@resources' filter to mastodon-web service --- dist/mastodon-sidekiq.service | 9 ++++++++- dist/mastodon-streaming.service | 8 +++++++- dist/mastodon-web.service | 9 ++++++++- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/dist/mastodon-sidekiq.service b/dist/mastodon-sidekiq.service index 35b121cd77..7d2d72e998 100644 --- a/dist/mastodon-sidekiq.service +++ b/dist/mastodon-sidekiq.service @@ -13,6 +13,9 @@ Environment="LD_PRELOAD=libjemalloc.so" ExecStart=/home/mastodon/.rbenv/shims/bundle exec sidekiq -c 25 TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -35,11 +38,15 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid +SystemCallFilter=@chown +SystemCallFilter=pipe +SystemCallFilter=pipe2 [Install] WantedBy=multi-user.target diff --git a/dist/mastodon-streaming.service b/dist/mastodon-streaming.service index 0befc529aa..6d71298a56 100644 --- a/dist/mastodon-streaming.service +++ b/dist/mastodon-streaming.service @@ -12,6 +12,9 @@ Environment="STREAMING_CLUSTER_NUM=1" ExecStart=/usr/bin/node ./streaming TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -34,11 +37,14 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @memlock @mount @obsolete @privileged @resources @setuid +SystemCallFilter=pipe +SystemCallFilter=pipe2 [Install] WantedBy=multi-user.target diff --git a/dist/mastodon-web.service b/dist/mastodon-web.service index f41efd2b09..16d1d5653c 100644 --- a/dist/mastodon-web.service +++ b/dist/mastodon-web.service @@ -13,6 +13,9 @@ ExecStart=/home/mastodon/.rbenv/shims/bundle exec puma -C config/puma.rb ExecReload=/bin/kill -SIGUSR1 $MAINPID TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -35,11 +38,15 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @resources @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid +SystemCallFilter=@chown +SystemCallFilter=pipe +SystemCallFilter=pipe2 [Install] WantedBy=multi-user.target