You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Michael Prokop a9bc9cdc78 TT#76552 Apply more strict systemd hardening ... In commit 31429319e7 we had to reduce our systemd hardening because ngcp-panel used the sendmail(1) interface for sending mails. Now that we switched from sendmail(1) to SMTP in commit 5993a1e1bc, we can finally re-apply the systemd hardening again. Original situation: [sipwise-lab-trunk] sipwise@sp1:~§ sudo SYSTEMD_COLORS=0 PAGER= COLUMNS=100 unbuffer systemd-analyze security ngcp-panel | grep -v '✓' NAME DESCRIPTION EXPOSURE [...] → Overall exposure level for ngcp-panel.service: 8.1 EXPOSED 🙁 [sipwise-lab-trunk] root@spce:~# New situation: [sipwise-lab-trunk] sipwise@sp1:~§ sudo SYSTEMD_COLORS=0 PAGER= COLUMNS=100 unbuffer systemd-analyze security ngcp-panel | grep -v '✓' NAME DESCRIPTION EXPOSURE ✗ SystemCallFilter=~@resources System call allow list defined for service,… 0.2 ✗ SystemCallFilter=~@privileged System call allow list defined for service,… 0.2 ✗ RootDirectory=/RootImage= Service runs within the host's root directo… 0.1 ✗ RestrictAddressFamilies=~AF_UNIX Service may allocate local sockets 0.1 ✗ RestrictAddressFamilies=~AF_(INET|INET6) Service may allocate Internet sockets 0.3 ✗ ProtectProc= Service has full access to process tree (/p… 0.2 ✗ ProcSubset= Service has full access to non-process /pro… 0.1 ✗ PrivateNetwork= Service has access to the host's network 0.5 ✗ PrivateUsers= Service has access to other users 0.2 ✗ DeviceAllow= Service has a device ACL with some special … 0.1 ✗ IPAddressDeny= Service does not define an IP address allow… 0.2 → Overall exposure level for ngcp-panel.service: 1.6 OK 🙂 [sipwise-lab-trunk] sipwise@sp1:~§ Change-Id: Id68cb73204ec9a20ebf54071ef41560c3f666407		3 weeks ago
..
source	MT#55524 Update lintian overrides for new lintian behavior	4 years ago
.gitignore	TT#124273 Update packaging for bullseye	5 years ago
changelog	Release new version 26.2.0.0+0~mr26.2.0.0	2 months ago
control	MT#65478 ngcp-panel-tools: add missing perl dependencies	3 weeks ago
copyright	MT#62899 Update packaging for Debian trixie	7 months ago
ngcp-api-testframework.install	TT#124273 Update packaging for bullseye	5 years ago
ngcp-panel-tools.install	TT#53701 Install into debian/tmp and select what to pick from there	7 years ago
ngcp-panel-tools.manpages	TT#33911 Perform 'wrap-and-sort -sat'	9 years ago
ngcp-panel-tools.postinst	TT#44809 Create the _ngcp-api group	8 years ago
ngcp-panel.install	MT#62763 Fix shellcheck issues	1 year ago
ngcp-panel.lintian-overrides	TT#34302 Remove /etc/{default,init.d}/ngcp-panel	8 years ago
ngcp-panel.maintscript	TT#34302 Remove /etc/{default,init.d}/ngcp-panel	8 years ago
ngcp-panel.postinst	MT#62899 Update packaging for Debian trixie	7 months ago
ngcp-panel.service	TT#76552 Apply more strict systemd hardening	3 weeks ago
ngcp-panel.tmpfiles	TT#124273 Update packaging for bullseye	5 years ago
rules	MT#62899 Update packaging for Debian trixie	7 months ago