TT#76552 Harden ngcp-rate-o-mat service

ngcp-rate-o-mat service state BEFORE this change:

| $ sudo systemd-analyze security ngcp-rate-o-mat | tail -1
| → Overall exposure level for ngcp-rate-o-mat.service: 9.6 UNSAFE 😨

ngcp-rate-o-mat service state AFTER this change:

| $ sudo systemd-analyze security ngcp-rate-o-mat | grep -v '✓'
|   NAME                                       DESCRIPTION                                                          EXPOSURE
| ✗ PrivateNetwork=                            Service has access to the host's network                                  0.5
| ✗ User=/DynamicUser=                         Service runs as root user                                                 0.4
| ✗ RestrictAddressFamilies=~AF_(INET|INET6)   Service may allocate Internet sockets                                     0.3
| ✗ DeviceAllow=                               Service has a device ACL with some special devices                        0.1
| ✗ IPAddressDeny=                             Service does not define an IP address allow list                          0.2
| ✗ ProtectClock=                              Service may write to the hardware clock or system clock                   0.2
| ✗ ProtectKernelLogs=                         Service may read from or write to the kernel log ring buffer              0.2
| ✗ ProtectProc=                               Service has full access to process tree (/proc hidepid=)                  0.2
| ✗ RestrictSUIDSGID=                          Service may create SUID/SGID files                                        0.2
| ✗ RootDirectory=/RootImage=                  Service runs within the host's root directory                             0.1
|   SupplementaryGroups=                       Service runs as root, option does not matter
|   RemoveIPC=                                 Service runs as root, option does not apply
| ✗ ProtectHostname=                           Service may change system host/domainname                                 0.1
| ✗ RestrictAddressFamilies=~AF_UNIX           Service may allocate local sockets                                        0.1
| ✗ ProcSubset=                                Service has full access to non-process /proc files (/proc subset=)        0.1
|
| → Overall exposure level for ngcp-rate-o-mat.service: 2.1 OK 🙂

NOTE: state with systemd v247.3-5 on bullseye

Change-Id: Iace478d9c5762cd641a333c0ea7d1b77b919a10d

debian/ngcp-rate-o-mat.service

@@ -9,6 +9,80 @@ EnvironmentFile=-/etc/default/ngcp-rate-o-mat
 ExecStart=/usr/sbin/ngcp-rate-o-mat
 ExecReload=/bin/kill -HUP $MAINPID
 
+# Service cannot create writable executable memory mappings that are writable and executable at the same time
+MemoryDenyWriteExecute=true
+
+# Service cannot modify the control group file system (via /sys/fs/cgroup)
+ProtectControlGroups=true
+
+# Service cannot load or read kernel modules
+ProtectKernelModules=true
+
+# Service cannot alter kernel tunables (/proc + /sys)
+ProtectKernelTunables=true
+
+# Service may execute system calls only with native ABI
+SystemCallArchitectures=native
+
+# Limit set of capabilities
+CapabilityBoundingSet=
+
+# Service process does not receive ambient capabilities
+AmbientCapabilities=
+
+# Service has no access to other software's temporary files
+PrivateTmp=true
+
+# Service has no access to hardware devices
+PrivateDevices=true
+
+# Service has no access to home directories
+ProtectHome=true
+
+# Service has strict read-only access to the OS file hierarchy
+ProtectSystem=strict
+
+# Limit write access
+ReadWritePaths=/run/
+
+# Service cannot change ABI personality
+LockPersonality=true
+
+# Turn off acquisition of new privileges system-wide
+NoNewPrivileges=true
+
+# Service has own user namespace, only root, nobody, and the uid/gid under which the service is running are mapped
+PrivateUsers=true
+
+# Service user cannot leave SysV IPC objects around
+# NOTE: service runs as root, so option does not matter
+RemoveIPC=true
+
+# Restrict access to the various process namespace types the Linux kernel provides
+RestrictNamespaces=true
+
+# Service may not acquire realtime scheduling
+RestrictRealtime=true
+
+# Files created by service are accessible only by service's own user by default
+UMask=0077
+
+# NOTE: Service needs access to the host's network, to access DB
+PrivateNetwork=false
+
+# Control access to specific device nodes by the executed processes
+DevicePolicy=closed
+
+# Maximum number of bytes of memory that may be locked into RAM
+LimitMEMLOCK=0
+
+# Restrict service to allocation of local sockets and network sockets only
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+# Restrict system calls that are allowed to be executed
+SystemCallFilter=@system-service
+SystemCallFilter=~@chown @clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @resources @swap
+
 [Install]
 WantedBy=multi-user.target
 Alias=rate-o-mat.service