From 8f3950eab41f1569d6992bb5215fca21622edab7 Mon Sep 17 00:00:00 2001 From: Michael Prokop Date: Thu, 30 Apr 2026 13:39:26 +0200 Subject: [PATCH] MT#49340 systemd hardening: restrict RestrictAddressFamilies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2026-31431 is relevant for services that permit the AF_ALG socket type. Let's restic access to expected sockets only. FTR, current state was: # systemd-analyze security ngcp-mediator | grep -v '✓' | grep RestrictAddressFamilies ✗ RestrictAddressFamilies=~AF_PACKET Service may allocate packet sockets 0.2 ✗ RestrictAddressFamilies=~AF_NETLINK Service may allocate netlink sockets 0.1 ✗ RestrictAddressFamilies=~AF_UNIX Service may allocate local sockets 0.1 ✗ RestrictAddressFamilies=~… Service may allocate exotic sockets 0.3 ✗ RestrictAddressFamilies=~AF_(INET|INET6) Service may allocate Internet sockets 0.3 Change-Id: I61377e74cdbbc394e95281b153cdf82c65a7f6e9 --- debian/ngcp-mediator.service | 3 +++ 1 file changed, 3 insertions(+) diff --git a/debian/ngcp-mediator.service b/debian/ngcp-mediator.service index 8a1bf20..5103561 100644 --- a/debian/ngcp-mediator.service +++ b/debian/ngcp-mediator.service @@ -58,6 +58,9 @@ PrivateUsers=true # NOTE: service runs as root, so option does not matter RemoveIPC=true +# Restrict service to allocation of certain address families only +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 + # Restrict access to the various process namespace types the Linux kernel provides RestrictNamespaces=true