aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAlex Kiernan <alex.kiernan@gmail.com>2020-04-23 15:12:06 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-04-26 13:58:45 +0100
commit3ed70b755d0b60e61e0871f8b0cca2e2ab5e13f9 (patch)
treefa9997a58ec14007c03144629da8e1787be7acf2
parenteeb1e236dab087b7565dbbf6979e2b4c03e56e91 (diff)
downloadopenembedded-core-contrib-3ed70b755d0b60e61e0871f8b0cca2e2ab5e13f9.tar.gz
rng-tools: Restrict rngd.service
Whilst rngd has to run as root, we can significantly constrain its permissions (network is only required if nistbeacon is enabled). Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-support/rng-tools/rng-tools/rngd.service19
-rw-r--r--meta/recipes-support/rng-tools/rng-tools_6.9.bb7
2 files changed, 26 insertions, 0 deletions
diff --git a/meta/recipes-support/rng-tools/rng-tools/rngd.service b/meta/recipes-support/rng-tools/rng-tools/rngd.service
index 084322ac40..0559b97991 100644
--- a/meta/recipes-support/rng-tools/rng-tools/rngd.service
+++ b/meta/recipes-support/rng-tools/rng-tools/rngd.service
@@ -8,6 +8,25 @@ Conflicts=shutdown.target
[Service]
EnvironmentFile=-@SYSCONFDIR@/default/rng-tools
ExecStart=@SBINDIR@/rngd -f $EXTRA_ARGS
+CapabilityBoundingSet=CAP_SYS_ADMIN
+IPAddressDeny=any
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=@system-service
[Install]
WantedBy=sysinit.target
diff --git a/meta/recipes-support/rng-tools/rng-tools_6.9.bb b/meta/recipes-support/rng-tools/rng-tools_6.9.bb
index 913342c315..8c98a9aa3a 100644
--- a/meta/recipes-support/rng-tools/rng-tools_6.9.bb
+++ b/meta/recipes-support/rng-tools/rng-tools_6.9.bb
@@ -49,4 +49,11 @@ do_install_append() {
-e 's,@SBINDIR@,${sbindir},g' \
${D}${sysconfdir}/init.d/rng-tools \
${D}${systemd_system_unitdir}/rngd.service
+
+ if [ "${@bb.utils.contains('PACKAGECONFIG', 'nistbeacon', 'yes', 'no', d)}" = "yes" ]; then
+ sed -i \
+ -e '/^IPAddressDeny=any/d' \
+ -e '/^RestrictAddressFamilies=/ s/$/ AF_INET AF_INET6/' \
+ ${D}${systemd_system_unitdir}/rngd.service
+ fi
}