chore: systemd hardening

加固 dbus 进程 Task: https://pms.uniontech.com/task-view-361197.html
linuxdeepin · Sep 4, 2024 · d398238 · d398238
1 parent e15b893
commit d398238
Show file tree

Hide file tree

Showing 3 changed files with 69 additions and 0 deletions.
diff --git a/misc/[email protected] b/misc/[email protected]
@@ -9,4 +9,27 @@ Restart=always
 RestartSec=3
 @SYSTEMD_SLICE@
 
+ReadOnlyPaths=/usr/share/deepin-service-manager/
+ReadOnlyPaths=/usr/lib/deepin-service-manager/
+
+DevicePolicy=closed
+
+ProtectSystem=full
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+ProtectHostname=yes
+ProtectClock=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+
 @SYSTEMD_INSTALL@
diff --git a/misc/deepin-service-manager.service.in b/misc/deepin-service-manager.service.in
@@ -8,4 +8,27 @@ Restart=always
 RestartSec=3
 @SYSTEMD_SLICE@
 
+ReadOnlyPaths=/usr/share/deepin-service-manager/
+ReadOnlyPaths=/usr/lib/deepin-service-manager/
+
+DevicePolicy=closed
+
+ProtectSystem=full
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+ProtectHostname=yes
+ProtectClock=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+
 @SYSTEMD_INSTALL@
diff --git a/misc/[email protected] b/misc/[email protected]
@@ -6,4 +6,27 @@ After=dbus.service
 ExecStart=/usr/bin/deepin-service-manager -n %i
 @SYSTEMD_SLICE@
 
+ReadOnlyPaths=/usr/share/deepin-service-manager/
+ReadOnlyPaths=/usr/lib/deepin-service-manager/
+
+DevicePolicy=closed
+
+ProtectSystem=full
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+ProtectHostname=yes
+ProtectClock=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+
 @SYSTEMD_INSTALL@