|
 |
ab4cc4 |
From 73a9c0902e7c97adf96e735407a75033152c04a9 Mon Sep 17 00:00:00 2001
|
|
|
ab4cc4 |
From: Bastien Nocera <hadess@hadess.net>
|
|
|
ab4cc4 |
Date: Wed, 13 Sep 2017 15:37:11 +0200
|
|
|
ab4cc4 |
Subject: [PATCH 3/4] systemd: Add more filesystem lockdown
|
|
|
ab4cc4 |
|
|
|
ab4cc4 |
We can only access the configuration file as read-only and read-write
|
|
|
ab4cc4 |
to the Bluetooth cache directory and sub-directories.
|
|
|
ab4cc4 |
---
|
|
|
ab4cc4 |
Makefile.am | 2 ++
|
|
|
ab4cc4 |
src/bluetooth.service.in | 4 ++++
|
|
|
ab4cc4 |
2 files changed, 6 insertions(+)
|
|
|
ab4cc4 |
|
|
|
ab4cc4 |
diff --git a/Makefile.am b/Makefile.am
|
|
|
ab4cc4 |
index 1c38d94e5..13ccf9079 100644
|
|
|
ab4cc4 |
--- a/Makefile.am
|
|
|
ab4cc4 |
+++ b/Makefile.am
|
|
|
ab4cc4 |
@@ -478,6 +478,8 @@ MAINTAINERCLEANFILES = Makefile.in \
|
|
|
ab4cc4 |
|
|
|
ab4cc4 |
SED_PROCESS = $(AM_V_GEN)$(MKDIR_P) $(dir $@) && \
|
|
|
ab4cc4 |
$(SED) -e 's,@libexecdir\@,$(libexecdir),g' \
|
|
|
ab4cc4 |
+ -e 's,@statedir\@,$(statedir),g' \
|
|
|
ab4cc4 |
+ -e 's,@confdir\@,$(confdir),g' \
|
|
|
ab4cc4 |
< $< > $@
|
|
|
ab4cc4 |
|
|
|
ab4cc4 |
%.service: %.service.in Makefile
|
|
|
ab4cc4 |
diff --git a/src/bluetooth.service.in b/src/bluetooth.service.in
|
|
|
ab4cc4 |
index a6f3030f9..7e55b5043 100644
|
|
|
ab4cc4 |
--- a/src/bluetooth.service.in
|
|
|
ab4cc4 |
+++ b/src/bluetooth.service.in
|
|
|
ab4cc4 |
@@ -17,6 +17,10 @@ LimitNPROC=1
|
|
|
ab4cc4 |
ProtectHome=true
|
|
|
ab4cc4 |
ProtectSystem=full
|
|
|
ab4cc4 |
PrivateTmp=true
|
|
|
ab4cc4 |
+ProtectKernelTunables=true
|
|
|
ab4cc4 |
+ProtectControlGroups=true
|
|
|
ab4cc4 |
+ReadWritePaths=@statedir@
|
|
|
ab4cc4 |
+ReadOnlyPaths=@confdir@
|
|
|
ab4cc4 |
|
|
|
ab4cc4 |
# Privilege escalation
|
|
|
ab4cc4 |
NoNewPrivileges=true
|
|
|
ab4cc4 |
--
|
|
|
ab4cc4 |
2.14.1
|
|
|
ab4cc4 |
|