[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #13805 [Tor]: Improve hardening in tor.service
#13805: Improve hardening in tor.service
----------------------+---------------------
Reporter: candrews | Owner:
Type: defect | Status: new
Priority: normal | Milestone:
Component: Tor | Version:
Keywords: systemd | Actual Points:
Parent ID: | Points:
----------------------+---------------------
I suggest that tor.service's hardening implementation be changed. These
lines would be replaced:
{{{
[Service]
DeviceAllow = /dev/null rw
DeviceAllow = /dev/urandom r
InaccessibleDirectories = /home
ReadOnlyDirectories = /
ReadWriteDirectories = /var/lib/tor
ReadWriteDirectories = /var/log/tor
ReadWriteDirectories = /var/run/tor
ReadWriteDirectories = /proc
}}}
With these lines:
{{{
PrivateDevices = yes
ProtectHome = yes
ProtectSystem = full
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID
}}}
Using PrivateDevices instead of DeviceAllow's is more secure as it create
a totally separate /dev as well as removing the CAP_MKNOD capability.
ProtectHome makes /home inaccessible, equivalent to
"InaccessibleDirectories = /home" but (arguably) more comprehensible.
ProtectSystem=full make /usr and /etc read only.
CapabilityBoundingSet reduces the process capability to just what it
needs.
See http://www.freedesktop.org/software/systemd/man/systemd.exec.html
This discussion was started at
https://bugs.gentoo.org/show_bug.cgi?id=529212 and the suggestion to use
the higher level constructs was made by the Gentoo systemd team.
For historical reference, tor.service was added in #8368
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13805>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs