diff options
| author | Lennart Poettering <lennart@poettering.net> | 2018-11-12 17:19:48 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2018-11-12 19:02:55 +0100 |
| commit | 3ca9940cb95cb263c6bfe5cfee72df232fe46a94 (patch) | |
| tree | 1aea17c3bc6b6f4f3abd129e973196d540b98d04 /units/systemd-resolved.service.in | |
| parent | d49881a06a3999938459692d953de8d7dd8f2cb2 (diff) | |
| download | systemd-3ca9940cb95cb263c6bfe5cfee72df232fe46a94.tar.gz | |
units: set NoNewPrivileges= for all long-running services
Previously, setting this option by default was problematic due to
SELinux (as this would also prohibit the transition from PID1's label to
the service's label). However, this restriction has since been lifted,
hence let's start making use of this universally in our services.
On SELinux system this change should be synchronized with a policy
update that ensures that NNP-ful transitions from init_t to service
labels is permitted.
An while we are at it: sort the settings in the unit files this touches.
This might increase the size of the change in this case, but hopefully
should result in stabler patches later on.
Fixes: #1219
Diffstat (limited to 'units/systemd-resolved.service.in')
| -rw-r--r-- | units/systemd-resolved.service.in | 37 |
1 files changed, 19 insertions, 18 deletions
diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index ef5398cbf0..3144b70063 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -20,31 +20,32 @@ Conflicts=shutdown.target Wants=nss-lookup.target [Service] -Type=notify -Restart=always -RestartSec=0 -ExecStart=!!@rootlibexecdir@/systemd-resolved -WatchdogSec=3min -User=systemd-resolve -CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -PrivateTmp=yes +CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +ExecStart=!!@rootlibexecdir@/systemd-resolved +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes -ProtectSystem=strict -ProtectHome=yes +PrivateTmp=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes +ProtectKernelTunables=yes +ProtectSystem=strict +Restart=always +RestartSec=0 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM -SystemCallArchitectures=native -LockPersonality=yes +RestrictNamespaces=yes +RestrictRealtime=yes RuntimeDirectory=systemd/resolve RuntimeDirectoryPreserve=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +Type=notify +User=systemd-resolve +WatchdogSec=3min [Install] WantedBy=multi-user.target |