You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Michael Prokop fa565ef32c TT#110904 TT#76552 Fix systemd hardening for carrier environments ... In carrier environments we have foreign DB hosts configured in /etc/ngcp-mediator/ngcp-mediator.conf, therefore we can't easily apply IP address filtering. JFTR, new and current systemd hardening state for ngcp-mediator: | $ sudo COLUMNS=142 systemd-analyze security ngcp-mediator | grep -v '✓' | NAME DESCRIPTION EXPOSURE | ✗ PrivateNetwork= Service has access to the host's … 0.5 | ✗ User=/DynamicUser= Service runs as root user 0.4 | ✗ RestrictAddressFamilies=~AF_(INET… Service may allocate Internet soc… 0.3 | ✗ RestrictAddressFamilies=~… Service may allocate exotic socke… 0.3 | ✗ DeviceAllow= Service has a device ACL with som… 0.1 | ✗ IPAddressDeny= Service does not define an IP add… 0.2 | ✗ RestrictAddressFamilies=~AF_PACKET Service may allocate packet socke… 0.2 | ✗ SystemCallFilter=~@privileged System call whitelist defined for… 0.2 | ✗ RestrictAddressFamilies=~AF_NETLI… Service may allocate netlink sock… 0.1 | ✗ RootDirectory=/RootImage= Service runs within the host's ro… 0.1 | SupplementaryGroups= Service runs as root, option does… | RemoveIPC= Service runs as root, option does… | ✗ RestrictAddressFamilies=~AF_UNIX Service may allocate local sockets 0.1 | | → Overall exposure level for ngcp-mediator.service: 2.1 OK 🙂 Change-Id: I0e7c474eddd5d4d4c77b9bda157448294ed0a5c4		6 years ago
.github/workflows	TT#108003 Add a coverity-scan GitHub workflow	6 years ago
debian	TT#110904 TT#76552 Fix systemd hardening for carrier environments	6 years ago
.gitignore	TT#108003 Update gitignore	6 years ago
.gitreview	MT#7505 Add gitreview file	12 years ago
ChangeLog	Added trunk/tags dir structure.	17 years ago
LICENSE	TT#14053 Add LICENSE file	10 years ago
Makefile	TT#108003 Add a coverity-scan GitHub workflow	6 years ago
cdr.c	TT#108003 Remove unused cdr_parse_json_get_uint64_clamped()	6 years ago
cdr.h	TT#76674 add support for concurrent calls tags	7 years ago
config.c	TT#76900 use separate host/port config for intermediate CDRs	7 years ago
config.h	TT#76900 use separate host/port config for intermediate CDRs	7 years ago
daemonizer.c	TT#33319 Implement redis backend for mediator	9 years ago
daemonizer.h	Added trunk/tags dir structure.	17 years ago
mediator.c	TT#65453 implement intermediate CDR writing	7 years ago
mediator.h	TT#51701 Switch from deprecated /var/lock to /run/lock	6 years ago
medmysql.c	TT#108003 use bool type instead of my_bool	6 years ago
medmysql.h	TT#90500 check and handle strings that are not UTF-8	6 years ago
medredis.c	TT#108003 Remove unused free()	6 years ago
medredis.h	TT#33319 Implement redis backend for mediator	9 years ago
records.c	TT#65453 implement intermediate CDR writing	7 years ago
records.h	TT#37553 always combine acc records from mysql and redis	8 years ago