Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

systemd: restrict permissions #778

Merged
merged 2 commits into from
Apr 8, 2024
Merged

systemd: restrict permissions #778

merged 2 commits into from
Apr 8, 2024

Commits on Apr 8, 2024

  1. packaging/systemd: restrict permissions 

    Forwarder does not need that many permissions, we can restrict it to minimum.

CAP_NET_BIND_SERVICE can be used to allow this user to bind to a port < 1024 if desired.

The work is based on wireproxy's systemd configuration[1]. Also I found systemd service hardening doc[2] helpful.

DynamicUser/Strict system protection didn't work as package installs forwarder binary at /usr/bin.

[1] pufferffish/wireproxy#103.
[2] https://gist.github.com/ageis/f5595e59b1cddb1513d1b425a323db04
    @Choraden
    Choraden committed Apr 8, 2024
    Configuration menu
    Copy the full SHA
    6258d54 View commit details
    Browse the repository at this point in the history

  2. local/linux: run container in privileged mode 

    Running systemd service in a container is not very common. We use it for testing, however it has its disadvantages.
Some container runtimes prohibit creating UTS namespaces. That leads to a warning:
"forwarder.service: ProtectHostname=yes is configured, but UTS namespace setup is prohibited (container manager?), ignoring namespace setup."
Giving a container privileged mode fixes this issue.
    @Choraden
    Choraden committed Apr 8, 2024
    Configuration menu
    Copy the full SHA
    b044cf0 View commit details
    Browse the repository at this point in the history