Harden systemd service with safe defaults - #800
Conversation
|
@tridge I read your blog about wanting to increase defense-in-depth on rsync. I believe this PR is complementary to that goal. Further improvements could be made, such as not running rsync daemon as root. But that would be a breaking change so I left that out for this. |
55051e7 to
9b4ade5
Compare
9b4ade5 to
a608777
Compare
LaserEyess
changed the title
|
Marking this as ready for review since there has been no negative feedback. |
|
Just a note that drafts are ordinarily not read, they are explicitly that, drafts. However; these cannot be described as universally safe defaults without testing representative writable modules, /tmp-backed modules/temp dirs, chroot, xattrs/ACLs, socket activation and the supported systemd versions. PrivateTmp alone can alter configured file visibility. Perhaps best as an optional hardening drop-in first. |
|
Fair enough about As for the other point, the tests, it doesn't look like a systemd service test exists. I only briefly glanced at |
This commit adds hardening to the systemd service with a variety of knobs designed to restrict damage that rsync can do as root, while making sure that no file transfers are interrupted. For example, ProtectHome= is still off, and CapabilityBoundingSet is still unlimited to allow for chown/chmod to work unimpeded. The rsync@.service has some additional options to restrict all network access and only use the socket on stdin. An equivalent change was done in rsync.service to only allow TCP, but full network isolation is not possible for that unit.
a608777 to
f903e95
Compare
2 participants
See commit message for an overview, but this is an RFC, I can understand if the project does not want this. The goal here is defense in depth. If there is a bug in any access control or authentication mechanism in rsync, there should be additional protections to not compromise a system running
rsync --daemonas root. This can be accomplished through systemd, so that the damage done by a hypothetical RCE is minimized as much as possible.I have personally tested this and it does not affect file transfers for either unit. That being said, I understand a lot of the options may be confusing. I can explain why each one of these is a safe default that does not affect file transfers.