Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Hardening systemd unit #451

Open
wants to merge 3 commits into
base: 1.1
Choose a base branch
from
Open

Hardening systemd unit #451

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
54e7bdf
Hardening systemd unit
marek22k Feb 1, 2024
3d70016
Allow control socket, PID and log file for Tinc 1.1 in systemd unit
marek22k Feb 1, 2024
fdef5cf
Remove configuration variables that are no longer used
marek22k Feb 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion systemd/meson.build
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ if dir_systemd == ''
endif

systemd_conf = configuration_data()
systemd_conf.set('sysconfdir', dir_sysconf)
systemd_conf.set('sbindir', dir_sbin)

configure_file(input: 'tinc.service.in',
Expand Down
2 changes: 1 addition & 1 deletion systemd/tinc.service.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/true
ExecReload=/bin/true
WorkingDirectory=@sysconfdir@/tinc
WorkingDirectory=%E/tinc

[Install]
WantedBy=multi-user.target
34 changes: 32 additions & 2 deletions systemd/[email protected]
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,39 @@ PartOf=tinc.service
ReloadPropagatedFrom=tinc.service

[Service]
RemoveIPC=true
NoNewPrivileges=true
ReadWritePaths=%L/tinc/ %t/tinc/
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @resources @swap
MemoryDenyWriteExecute=true
RestrictSUIDSGID=true
LockPersonality=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictRealtime=true
RestrictNamespaces=true
ProtectSystem=strict
ProtectHome=true
ProtectClock=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelTunables=true
ProtectProc=ptraceable
ProcSubset=pid
PrivateTmp=true
PrivateMounts=true
DeviceAllow=/dev/net/tun rwm
DeviceAllow=/dev/net/tap rwm

Type=notify
WorkingDirectory=@sysconfdir@/tinc/%i
ExecStart=@sbindir@/tincd -n %i -D
WorkingDirectory=%E/tinc/%i
RuntimeDirectory=tinc
LogsDirectory=tinc
ExecStart=@sbindir@/tincd -n %i --pidfile=%t/tinc/%i.pid --logfile=%L/tinc/%i.log -D
ExecReload=@sbindir@/tinc -n %i reload
KillMode=mixed
Restart=on-failure
Expand Down
Loading