From: Bastien Nocera <hadess@hadess.net>
To: linux-bluetooth@vger.kernel.org
Cc: Craig Andrews <candrews@integralblue.com>
Subject: [PATCH 2/4] systemd: Add PrivateTmp and NoNewPrivileges options
Date: Wed, 20 Sep 2017 13:48:17 +0200 [thread overview]
Message-ID: <20170920114819.19929-2-hadess@hadess.net> (raw)
In-Reply-To: <20170920114819.19929-1-hadess@hadess.net>
From: Craig Andrews <candrews@integralblue.com>
PrivateTmp makes bluetoothd's /tmp and /var/tmp be inside a different
namespace. This is useful to secure access to temporary files of the
process.
NoNewPrivileges ensures that service process and all its children
can never gain new privileges through execve(), lowering the risk of
possible privilege escalations.
---
src/bluetooth.service.in | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/bluetooth.service.in b/src/bluetooth.service.in
index f799f65f0..a6f3030f9 100644
--- a/src/bluetooth.service.in
+++ b/src/bluetooth.service.in
@@ -12,8 +12,14 @@ NotifyAccess=main
#Restart=on-failure
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
LimitNPROC=1
+
+# Filesystem lockdown
ProtectHome=true
ProtectSystem=full
+PrivateTmp=true
+
+# Privilege escalation
+NoNewPrivileges=true
[Install]
WantedBy=bluetooth.target
--
2.14.1
next prev parent reply other threads:[~2017-09-20 11:48 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-20 11:48 [PATCH 1/4] build: Always define confdir and statedir Bastien Nocera
2017-09-20 11:48 ` Bastien Nocera [this message]
2017-09-20 11:48 ` [PATCH 3/4] systemd: Add more filesystem lockdown Bastien Nocera
2017-09-20 11:48 ` [PATCH 4/4] systemd: More lockdown Bastien Nocera
2017-11-24 14:15 ` [PATCH 1/4] build: Always define confdir and statedir Bastien Nocera
-- strict thread matches above, loose matches on Subject: below --
2022-01-26 11:36 Bastien Nocera
2022-01-26 11:36 ` [PATCH 2/4] systemd: Add PrivateTmp and NoNewPrivileges options Bastien Nocera
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170920114819.19929-2-hadess@hadess.net \
--to=hadess@hadess.net \
--cc=candrews@integralblue.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox