sipwise
/
ngcp-panel
mirror of https://github.com/sipwise/ngcp-panel.git
1
0
Fork 0
Code Issues Releases Wiki Activity

TT#76552 Apply more strict systemd hardening

Browse Source 
In commit 31429319e7 we had to reduce our
systemd hardening because ngcp-panel used the sendmail(1) interface for
sending mails.

Now that we switched from sendmail(1) to SMTP in commit
5993a1e1bc, we can finally re-apply the
systemd hardening again.

Original situation:

  [sipwise-lab-trunk] sipwise@sp1:~§ sudo SYSTEMD_COLORS=0 PAGER= COLUMNS=100 unbuffer systemd-analyze security ngcp-panel | grep -v '✓'
    NAME                                         DESCRIPTION                                  EXPOSURE
  [...]
  → Overall exposure level for ngcp-panel.service: 8.1 EXPOSED 🙁
  [sipwise-lab-trunk] root@spce:~#

New situation:

  [sipwise-lab-trunk] sipwise@sp1:~§ sudo SYSTEMD_COLORS=0 PAGER= COLUMNS=100 unbuffer systemd-analyze security ngcp-panel | grep -v '✓'
    NAME                                         DESCRIPTION                                  EXPOSURE
  ✗ SystemCallFilter=~@resources                 System call allow list defined for service,…      0.2
  ✗ SystemCallFilter=~@privileged                System call allow list defined for service,…      0.2
  ✗ RootDirectory=/RootImage=                    Service runs within the host's root directo…      0.1
  ✗ RestrictAddressFamilies=~AF_UNIX             Service may allocate local sockets                0.1
  ✗ RestrictAddressFamilies=~AF_(INET|INET6)     Service may allocate Internet sockets             0.3
  ✗ ProtectProc=                                 Service has full access to process tree (/p…      0.2
  ✗ ProcSubset=                                  Service has full access to non-process /pro…      0.1
  ✗ PrivateNetwork=                              Service has access to the host's network          0.5
  ✗ PrivateUsers=                                Service has access to other users                 0.2
  ✗ DeviceAllow=                                 Service has a device ACL with some special …      0.1
  ✗ IPAddressDeny=                               Service does not define an IP address allow…      0.2

  → Overall exposure level for ngcp-panel.service: 1.6 OK 🙂
  [sipwise-lab-trunk] sipwise@sp1:~§

Change-Id: Id68cb73204ec9a20ebf54071ef41560c3f666407
mr26.2
Michael Prokop 2 months ago
parent ca8a56755a
commit a9bc9cdc78
1 changed files with 50 additions and 31 deletions
Show Stats Download Patch File Download Diff File

81
debian/ngcp-panel.service vendored
Unescape View File

@ -16,6 +16,9 @@ RuntimeDirectoryPreserve=yes
PIDFile=/run/fastcgi/ngcp-panel.pid
ExecStart=/usr/share/ngcp-panel/ngcp_panel_fastcgi.pl --listen /run/fastcgi/ngcp-panel.sock --pidfile /run/fastcgi/ngcp-panel.pid --nproc $NPROC
# Service cannot create writable executable memory mappings that are writable and executable at the same time
MemoryDenyWriteExecute=true
# Files + directories not directly associated are made invisible in the /proc/ file system
# ProcSubset=pid
# Disabled: MT#58964, to be able to read /proc/ngcp/flags/
@ -24,30 +27,56 @@ ExecStart=/usr/share/ngcp-panel/ngcp_panel_fastcgi.pl --listen /run/fastcgi/ngcp
# ProtectProc=invisible
# Disabled: MT#58964, to be able to read /proc/ngcp/flags/
# Writes to the hardware clock or system clock will be denied
ProtectClock=true
# Service cannot modify the control group file system (via /sys/fs/cgroup)
ProtectControlGroups=true
# Service has no access to home directories
ProtectHome=true
# Set up new UTS namespace for the executed processes + changing hostname or domainname is prevented
ProtectHostname=true
# Service cannot load or read kernel modules
ProtectKernelModules=true
# Service cannot alter kernel tunables (/proc + /sys)
ProtectKernelTunables=true
# Service has strict read-only access to the OS file hierarchy
ProtectSystem=strict
# Access to the kernel log ring buffer will be denied
ProtectKernelLogs=true
# Service may execute system calls only with native ABI
SystemCallArchitectures=native
# Limit set of capabilities
CapabilityBoundingSet=
# Service process does not receive ambient capabilities
AmbientCapabilities=
# Service has no access to other software's temporary files
PrivateTmp=true
# Service has strict read-only access to the OS file hierarchy
ProtectSystem=strict
# Service has no access to hardware devices
PrivateDevices=true
# Limit write access
# NOTE: we need r/w access to ngcp-panel/Catalyst tmp folder
ReadWritePaths=/ngcp-data/tmp/www-data/
# NOTE: we need r/w access to /ngcp-data/spool/faxserver for sending fax
ReadWritePaths=-/ngcp-data/spool/faxserver
# NOTE: we need r/w access for sendmail usage with exim
ReadWritePaths=-/var/spool/exim4/
ReadWritePaths=-/var/log/exim4/
ReadWritePaths=-/var/mail/
# Service cannot change ABI personality
LockPersonality=true
# Turn off acquisition of new privileges system-wide
NoNewPrivileges=true
# Service has own user namespace, only root, nobody, and the uid/gid under which the service is running are mapped
# NOTE: we can't have our own user namespace, as we need proper permissions e.g. to /ngcp-data/spool/faxserver
@ -57,6 +86,18 @@ PrivateUsers=false
# NOTE: service runs as root, so option does not matter
RemoveIPC=true
# Restrict service to allocation of local, ipv4 + ipv6 sockets
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
# Restrict access to the various process namespace types the Linux kernel provides
RestrictNamespaces=true
# Service may not acquire realtime scheduling
RestrictRealtime=true
# Attempts to set SUID or SGID bits on files or directories will be denied
RestrictSUIDSGID=true
# Files created by service are accessible only by service's own user by default
UMask=0077
@ -72,36 +113,14 @@ IPAddressAllow=any
# Maximum number of bytes of memory that may be locked into RAM
LimitMEMLOCK=0
# NOTE: we need to allow acquisition of new privileges, otherwise sendmail fails to work
NoNewPrivileges=false
# {{{
# NOTE: all of the following hardenings need to stay disabled, as long as we use the
# sendmail(1) interface via perl's Email::Sender::Transport::Sendmail library
#CapabilityBoundingSet=
#LockPersonality=true
#MemoryDenyWriteExecute=true
#PrivateDevices=true
#ProtectClock=true
#ProtectHostname=true
#ProtectKernelLogs=true
#ProtectKernelModules=true
#ProtectKernelTunables=true
#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
#RestrictNamespaces=true
#RestrictRealtime=true
#RestrictSUIDSGID=true
#SystemCallArchitectures=native
# Restrict system calls that are allowed to be executed
# NOTE: @system-service => reasonable set of system calls used by common system services
#SystemCallFilter=@system-service
SystemCallFilter=@system-service
# NOTE: return with ENOSYS instead of terminating the process immediately
#SystemCallErrorNumber=ENOSYS
SystemCallErrorNumber=ENOSYS
# All system calls except the listed ones will be logged
#SystemCallLog=~@system-service seccomp
# }}}
SystemCallLog=~@system-service seccomp
[Install]
WantedBy=multi-user.target

Write Preview
Loading…
Cancel
Save