4 ms·

For those that don’t know, you shouldn’t blindly let programs have access to tmp. They can get access to sockets and stuff. If you’re running with systemd there

For those that don’t know, you shouldn’t blindly let programs have access to tmp. They can get access to sockets and stuff. If you’re running with systemd there’s a private tmp option for this reason. It’s always best to sandbox programs when you can. Linux has been making this much easier but it’s still non trivial https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/

westurner 2y ago
From the systemd.exec man page: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#PrivateTmp= https://www.freedesktop.org/software/systemd/man/systemd.exe... : PrivateTmp=true #JoinsNamespaceOf= `unshare -m` and then bind-mounting a private /tmp at /tmp/systemd-private-/ does the same thing; `systemd-tmpfiles --help`: https://serverfault.com/questions/1010339/how-exactly-to-use-systemd-private-temporary-directory-feature/1142519#1142519 https://serverfault.com/questions/1010339/how-exactly-to-use...
- mikepurvis 2y ago
  "`unshare -m` and then bind-mounting a private /tmp at /tmp/systemd-private-/ does the same thing" As an intermediate level user and sysadmin, this kind of thing underscores the good work systemd is doing making it easy to get sane and safe defaults for things otherwise fiddly enough that many normal people wouldn't bother.
  - westurner 2y ago
    And in a config file format so we don't have to add things like renice, respawn, chroot, and namespaces to a locally forked Sys-V unit script for just one distro. Thankful for systemd too.
mjevans 2y ago
Isn't that the entire point of each socket living inside of a directory with privs / ACL protecting it?
- godelski 2y ago
  Yeah that helps but it depends on the permission of the socket. You can make it harder to guess by changing control path. Here’s an article that talks about tmp[0]. But I mean if you wanted to be really secure you could use systemd nspawn and put each user into their own container[1] [0] https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/ [1] https://kilabit.info/journal/2022/chrooting_ssh_user_into_systemd-nspawn/ https://kilabit.info/journal/2022/chrooting_ssh_user_into_sy...

westurner 2y ago

From the systemd.exec man page: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#PrivateTmp= https://www.freedesktop.org/software/systemd/man/systemd.exe... : PrivateTmp=true #JoinsNamespaceOf= `unshare -m` and then bind-mounting a private /tmp at /tmp/systemd-private-/ does the same thing; `systemd-tmpfiles --help`: https://serverfault.com/questions/1010339/how-exactly-to-use-systemd-private-temporary-directory-feature/1142519#1142519 https://serverfault.com/questions/1010339/how-exactly-to-use...

mikepurvis 2y ago
"`unshare -m` and then bind-mounting a private /tmp at /tmp/systemd-private-/ does the same thing" As an intermediate level user and sysadmin, this kind of thing underscores the good work systemd is doing making it easy to get sane and safe defaults for things otherwise fiddly enough that many normal people wouldn't bother.
- westurner 2y ago
  And in a config file format so we don't have to add things like renice, respawn, chroot, and namespaces to a locally forked Sys-V unit script for just one distro. Thankful for systemd too.

mjevans 2y ago

Isn't that the entire point of each socket living inside of a directory with privs / ACL protecting it?

godelski 2y ago
Yeah that helps but it depends on the permission of the socket. You can make it harder to guess by changing control path. Here’s an article that talks about tmp[0]. But I mean if you wanted to be really secure you could use systemd nspawn and put each user into their own container[1] [0] https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/ [1] https://kilabit.info/journal/2022/chrooting_ssh_user_into_systemd-nspawn/ https://kilabit.info/journal/2022/chrooting_ssh_user_into_sy...