83f96efdfd
Add various settings to the example chronyd and chrony-wait services to decrease the exposure reported by the "systemd-analyze security" command. The original exposure was high as the analyzer does not check the actual process (e.g. that it dropped the root privileges or that it has its own seccomp filter). Limit read-write access to /run, /var/lib/chrony, and /var/spool. Access to /run (instead of /run/chrony) is needed for the refclock socket expected by gpsd. The mailonchange directive is most likely to break as it executes /usr/sbin/sendmail, which can do unexpected operations depending on the implementation. It should work with a setuid/setgid binary, but it is not expected to write outside of /var/spool and the private /tmp.
47 lines
1.1 KiB
Desktop File
47 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Wait for chrony to synchronize system clock
|
|
Documentation=man:chronyc(1)
|
|
After=chronyd.service
|
|
Requires=chronyd.service
|
|
Before=time-sync.target
|
|
Wants=time-sync.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# Wait for chronyd to update the clock and the remaining
|
|
# correction to be less than 0.1 seconds
|
|
ExecStart=/usr/bin/chronyc -h 127.0.0.1,::1 waitsync 0 0.1 0.0 1
|
|
# Wait for at most 3 minutes
|
|
TimeoutStartSec=180
|
|
RemainAfterExit=yes
|
|
StandardOutput=null
|
|
|
|
CapabilityBoundingSet=
|
|
DevicePolicy=closed
|
|
DynamicUser=yes
|
|
IPAddressAllow=localhost
|
|
IPAddressDeny=any
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
PrivateDevices=yes
|
|
PrivateUsers=yes
|
|
ProcSubset=pid
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources
|
|
UMask=0777
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|