3 ms·

> Most services on my machines are heavily locked down and isolated from each other since systemd makes this very easy Do you have a guide handy? A quick Googl

> Most services on my machines are heavily locked down and isolated from each other since systemd makes this very easy Do you have a guide handy? A quick Google search only showed generic nonsense. I'll appreciate a recipe-like pointer. Been curious about this for a while.

5e92cb50239222b 4y ago
I haven't seen any decent articles on this (doesn't mean there aren't any) that mention anything besides most basic flags. Have a gander at the comment I linked (https://news.ycombinator.com/item?id=29976096 https://news.ycombinator.com/item?id=29976096). --- Probably the easiest way to start is to create your unit file as usual, copy the list from the comment into it, and then run: $ systemd-analyze security unit-name It prints a huge list of suggestions along with a short description of each one. Look up their names in here: $ man systemd.directives and look at the man linked there. Usually it's one of $ man systemd.exec $ man systemd.resource-control I think the starter list should get you 95% there (I use it for most applications with minor variations in paths and flags like MemoryDenyWriteExecute that breaks JIT compilers). --- If you want to keep your configuration as short as possible, the list with the most bang for your buck would look something like this: User=non-root-username # disable privilege escalation through SUID binaries NoNewPrivileges=yes CapabilityBoundingSet= # removes access to /home ProtectHome=yes # makes most paths read-only ProtectSystem=strict # opens read-write access only to paths your application needs ReadWritePaths=/var/lib/foo /var/lib/bar If your application follows FHS and writes stuff to /var/whatever, prefer: RuntimeDirectory=appname StateDirectory=appname CacheDirectory=appname LogsDirectory=appname ConfigurationDirectory=appname instead of RuntimeDirectory=/var/run/appname StateDirectory=/var/lib/appname CacheDirectory=/var/cache/appname LogsDirectory=/var/log/appname ConfigurationDirectory=/etc/appname
- pdimitar 4y ago
  Thanks a bunch! I'm absolutely bookmarking your comment and will go back to it.
prmoustache 4y ago
> Keep in mind that Oracle is the copyright holder of ZFS. So you (and Ubuntu) are violating Oracle's license terms. Would be realy interesting to see what happens if Oracle decides to sue an Ubuntu user. Would Ubuntu step in to help? There is nothing in the CDDL that prevent a user to use ZFS with a kernel under GPL license and no leverage for Oracle to sue the end user for this. The end user is not distributing the software. Ubuntu or possibly an hosting provider or a company incorporating ubuntu in its product does.

5e92cb50239222b 4y ago

I haven't seen any decent articles on this (doesn't mean there aren't any) that mention anything besides most basic flags. Have a gander at the comment I linked (https://news.ycombinator.com/item?id=29976096 https://news.ycombinator.com/item?id=29976096). --- Probably the easiest way to start is to create your unit file as usual, copy the list from the comment into it, and then run: $ systemd-analyze security unit-name It prints a huge list of suggestions along with a short description of each one. Look up their names in here: $ man systemd.directives and look at the man linked there. Usually it's one of $ man systemd.exec $ man systemd.resource-control I think the starter list should get you 95% there (I use it for most applications with minor variations in paths and flags like MemoryDenyWriteExecute that breaks JIT compilers). --- If you want to keep your configuration as short as possible, the list with the most bang for your buck would look something like this: User=non-root-username # disable privilege escalation through SUID binaries NoNewPrivileges=yes CapabilityBoundingSet= # removes access to /home ProtectHome=yes # makes most paths read-only ProtectSystem=strict # opens read-write access only to paths your application needs ReadWritePaths=/var/lib/foo /var/lib/bar If your application follows FHS and writes stuff to /var/whatever, prefer: RuntimeDirectory=appname StateDirectory=appname CacheDirectory=appname LogsDirectory=appname ConfigurationDirectory=appname instead of RuntimeDirectory=/var/run/appname StateDirectory=/var/lib/appname CacheDirectory=/var/cache/appname LogsDirectory=/var/log/appname ConfigurationDirectory=/etc/appname

pdimitar 4y ago
Thanks a bunch! I'm absolutely bookmarking your comment and will go back to it.

prmoustache 4y ago

> Keep in mind that Oracle is the copyright holder of ZFS. So you (and Ubuntu) are violating Oracle's license terms. Would be realy interesting to see what happens if Oracle decides to sue an Ubuntu user. Would Ubuntu step in to help? There is nothing in the CDDL that prevent a user to use ZFS with a kernel under GPL license and no leverage for Oracle to sue the end user for this. The end user is not distributing the software. Ubuntu or possibly an hosting provider or a company incorporating ubuntu in its product does.