gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 40901: (follow-up) Systemd hardening 

I think the following systemd security measures are safe for Koha:

ProtectSystem=full
Sets /usr & /boot to read-only

ProtectHome=yes
Hides /home, /root and /run/user
NOTE: The hiding of /run/user through me off, but google says it's only for
interactive logins only. AFAIK the only thing that does that is
koha-shell which isn't a systemd thing so it is unaffected

PrivateTmp=yes
Private /tmp & /var/tmp
NOTE: AFACT nothing in Koha shares files via /tmp which feels like it
would be a bad thing to do anyway

NoNewPrivileges=yes
setuid binaries can't re-elevate
NOTE: This feels like the most important one!

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
This commit is contained in:
Kyle M Hall 2026-05-12 13:08:49 -04:00 committed by Pedro Amorim
parent 05228589ed
commit b5000b8869
No known key found for this signature in database
GPG Key ID: 06B75BA7F3894D55
8 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
debian/systemd/koha-es-indexer@.service vendored
View File

@ -17,6 +17,10 @@ Environment=PERL5LIB=/usr/share/koha/lib
ExecStartPre=+/usr/sbin/koha-generate-env es-indexer %i
EnvironmentFile=-/run/koha/%i/es-indexer.env
ExecStart=/usr/share/koha/bin/workers/es_indexer_daemon.pl --batch_size ${ES_BATCH_SIZE}
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
Restart=on-failure
RestartSec=5s

4
debian/systemd/koha-indexer@.service vendored
View File

@ -17,6 +17,10 @@ Environment=PERL5LIB=/usr/share/koha/lib
ExecStartPre=+/usr/sbin/koha-generate-env indexer %i
EnvironmentFile=-/run/koha/%i/indexer.env
ExecStart=/usr/share/koha/bin/migration_tools/rebuild_zebra.pl -daemon -sleep ${INDEXER_TIMEOUT}
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
Restart=on-failure
RestartSec=30s

4
debian/systemd/koha-plack@.service vendored
View File

@ -30,6 +30,10 @@ ExecStart=/usr/bin/starman \
--listen /var/run/koha/%i/plack.sock \
${PLACK_PSGIFILE}
ExecReload=/bin/kill -HUP $MAINPID
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
Restart=on-failure
RestartSec=5s

4
debian/systemd/koha-sip@.service vendored
View File

@ -17,6 +17,10 @@ Environment=KOHA_CONF=/etc/koha/sites/%i/koha-conf.xml
Environment=KOHA_HOME=/usr/share/koha
Environment=PERL5LIB=/usr/share/koha/lib
ExecStart=/usr/bin/perl /usr/share/koha/lib/C4/SIP/SIPServer.pm /etc/koha/sites/%i/SIPconfig.xml
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
Restart=on-failure
RestartSec=5s

4
debian/systemd/koha-worker-long_tasks@.service vendored
View File

@ -15,6 +15,10 @@ Environment=KOHA_CONF=/etc/koha/sites/%i/koha-conf.xml
Environment=KOHA_HOME=/usr/share/koha
Environment=PERL5LIB=/usr/share/koha/lib
ExecStart=/usr/share/koha/bin/workers/background_jobs_worker.pl --queue long_tasks
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
Restart=on-failure
RestartSec=5s

4
debian/systemd/koha-worker@.service vendored
View File

@ -15,6 +15,10 @@ Environment=KOHA_CONF=/etc/koha/sites/%i/koha-conf.xml
Environment=KOHA_HOME=/usr/share/koha
Environment=PERL5LIB=/usr/share/koha/lib
ExecStart=/usr/share/koha/bin/workers/background_jobs_worker.pl --queue default
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
Restart=on-failure
RestartSec=5s

4
debian/systemd/koha-z3950@.service vendored
View File

@ -25,6 +25,10 @@ ExecStart=/usr/share/koha/bin/z3950_responder.pl \
-D \
-d %i-koha-z3950 \
-l /var/log/koha/%i/z3950.log
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
Restart=on-failure
RestartSec=5s

4
debian/systemd/koha-zebra@.service vendored
View File

@ -25,6 +25,10 @@ ExecStart=/usr/bin/zebrasrv \
-m '%%FT%%T' \
-p /var/run/koha/%i/zebra.pid \
-D
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
Restart=on-failure
RestartSec=30s