diff options
| author |   Alex Kiernan <alex.kiernan@gmail.com> | 2020-04-23 15:12:06 +0100 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-04-26 13:58:45 +0100 |
| commit | 3ed70b755d0b60e61e0871f8b0cca2e2ab5e13f9 (patch) | |
| tree | fa9997a58ec14007c03144629da8e1787be7acf2 /meta/recipes-support | |
| parent | eeb1e236dab087b7565dbbf6979e2b4c03e56e91 (diff) | |
| download | openembedded-core-contrib-3ed70b755d0b60e61e0871f8b0cca2e2ab5e13f9.tar.gz | |
rng-tools: Restrict rngd.service
Whilst rngd has to run as root, we can significantly constrain its
permissions (network is only required if nistbeacon is enabled).
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-support')
| -rw-r--r-- | meta/recipes-support/rng-tools/rng-tools/rngd.service | 19 | ||||
| -rw-r--r-- | meta/recipes-support/rng-tools/rng-tools_6.9.bb | 7 |
2 files changed, 26 insertions, 0 deletions
diff --git a/meta/recipes-support/rng-tools/rng-tools/rngd.service b/meta/recipes-support/rng-tools/rng-tools/rngd.service index 084322ac40..0559b97991 100644 --- a/meta/recipes-support/rng-tools/rng-tools/rngd.service +++ b/meta/recipes-support/rng-tools/rng-tools/rngd.service @@ -8,6 +8,25 @@ Conflicts=shutdown.target [Service] EnvironmentFile=-@SYSCONFDIR@/default/rng-tools ExecStart=@SBINDIR@/rngd -f $EXTRA_ARGS +CapabilityBoundingSet=CAP_SYS_ADMIN +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelModules=yes +ProtectKernelLogs=yes +ProtectSystem=strict +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service [Install] WantedBy=sysinit.target diff --git a/meta/recipes-support/rng-tools/rng-tools_6.9.bb b/meta/recipes-support/rng-tools/rng-tools_6.9.bb index 913342c315..8c98a9aa3a 100644 --- a/meta/recipes-support/rng-tools/rng-tools_6.9.bb +++ b/meta/recipes-support/rng-tools/rng-tools_6.9.bb @@ -49,4 +49,11 @@ do_install_append() { -e 's,@SBINDIR@,${sbindir},g' \ ${D}${sysconfdir}/init.d/rng-tools \ ${D}${systemd_system_unitdir}/rngd.service + + if [ "${@bb.utils.contains('PACKAGECONFIG', 'nistbeacon', 'yes', 'no', d)}" = "yes" ]; then + sed -i \ + -e '/^IPAddressDeny=any/d' \ + -e '/^RestrictAddressFamilies=/ s/$/ AF_INET AF_INET6/' \ + ${D}${systemd_system_unitdir}/rngd.service + fi } |