colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

rsync-net: fix sandboxing (dont set PrivateUsers: we lose perms in the root ns doing that)

Browse Source
This commit is contained in:
Colin
2024-08-03 11:25:50 +00:00
parent ee062d61d0
commit 04fc601c9c
1 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
hosts/modules/services/rsync-net/default.nix
View File

@@ -56,14 +56,16 @@ in
serviceConfig.CapabilityBoundingSet = [ "CAP_DAC_READ_SEARCH" ]; serviceConfig.CapabilityBoundingSet = [ "CAP_DAC_READ_SEARCH" ];
serviceConfig.ReadWritePaths = builtins.map (d: "${d}/zzz-rsync-net") cfg.dirs; serviceConfig.ReadWritePaths = builtins.map (d: "${d}/zzz-rsync-net") cfg.dirs;
serviceConfig.ReadOnlyPaths = "/nix/persist/private"; serviceConfig.ReadOnlyPaths = "/nix/persist/private";
serviceConfig.RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK"; serviceConfig.RestrictAddressFamilies = "AF_INET AF_INET6";
serviceConfig.LockPersonality = true; serviceConfig.LockPersonality = true;
serviceConfig.MemoryDenyWriteExecute = true; serviceConfig.MemoryDenyWriteExecute = true;
serviceConfig.NoNewPrivileges = true;
serviceConfig.PrivateDevices = true;
serviceConfig.PrivateMounts = true; serviceConfig.PrivateMounts = true;
serviceConfig.PrivateUsers = true; serviceConfig.PrivateTmp = true;
serviceConfig.ProcSubset = "pid"; serviceConfig.ProcSubset = "pid";
serviceConfig.ProtectClock = "true"; serviceConfig.ProtectClock = true;
serviceConfig.ProtectControlGroups = true; serviceConfig.ProtectControlGroups = true;
serviceConfig.ProtectHome = true; serviceConfig.ProtectHome = true;
serviceConfig.ProtectHostname = true; serviceConfig.ProtectHostname = true;
@@ -73,13 +75,23 @@ in
serviceConfig.ProtectProc = "invisible"; serviceConfig.ProtectProc = "invisible";
serviceConfig.ProtectSystem = "strict"; serviceConfig.ProtectSystem = "strict";
serviceConfig.RemoveIPC = true; serviceConfig.RemoveIPC = true;
serviceConfig.RestrictFileSystems = "@basic-api @common-block @temporary";
serviceConfig.RestrictNamespaces = true;
serviceConfig.RestrictSUIDSGID = true; serviceConfig.RestrictSUIDSGID = true;
serviceConfig.SystemCallArchitectures = "native"; serviceConfig.SystemCallArchitectures = "native";
serviceConfig.SystemCallFilter = "@system-service @mount"; serviceConfig.SystemCallFilter = [
"@system-service"
"~@chown"
"~@cpu-emulation"
"~@keyring"
"~@setuid"
];
# hardening exceptions: # hardening exceptions:
serviceConfig.NoNewPrivileges = false; #< bwrap'd dac_read_search serviceConfig.PrivateUsers = false; #< CAP_DAC_READ_SEARCH in the root namespace means we can't do any user namespacing
serviceConfig.PrivateDevices = false; #< passt/pasta # serviceConfig.NoNewPrivileges = false; #< bwrap'd dac_read_search
serviceConfig.RestrictNamespaces = false; #< bwrap # serviceConfig.PrivateDevices = false; #< passt/pasta
# serviceConfig.RestrictNamespaces = false; #< bwrap
# serviceConfig.RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK"; #< AF_NETLINK is for passt/pasta
}; };
systemd.timers.rsync-net = { systemd.timers.rsync-net = {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];