From b5000b88696306bb8a92615c883316b84f7ef43e Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Tue, 12 May 2026 13:08:49 -0400 Subject: [PATCH] Bug 40901: (follow-up) Systemd hardening I think the following systemd security measures are safe for Koha: ProtectSystem=full Sets /usr & /boot to read-only ProtectHome=yes Hides /home, /root and /run/user NOTE: The hiding of /run/user through me off, but google says it's only for interactive logins only. AFAIK the only thing that does that is koha-shell which isn't a systemd thing so it is unaffected PrivateTmp=yes Private /tmp & /var/tmp NOTE: AFACT nothing in Koha shares files via /tmp which feels like it would be a bad thing to do anyway NoNewPrivileges=yes setuid binaries can't re-elevate NOTE: This feels like the most important one! Signed-off-by: Kyle M Hall Signed-off-by: Martin Renvoize Signed-off-by: Pedro Amorim --- debian/systemd/koha-es-indexer@.service | 4 ++++ debian/systemd/koha-indexer@.service | 4 ++++ debian/systemd/koha-plack@.service | 4 ++++ debian/systemd/koha-sip@.service | 4 ++++ debian/systemd/koha-worker-long_tasks@.service | 4 ++++ debian/systemd/koha-worker@.service | 4 ++++ debian/systemd/koha-z3950@.service | 4 ++++ debian/systemd/koha-zebra@.service | 4 ++++ 8 files changed, 32 insertions(+) diff --git a/debian/systemd/koha-es-indexer@.service b/debian/systemd/koha-es-indexer@.service index f963105ec8..294edbacae 100644 --- a/debian/systemd/koha-es-indexer@.service +++ b/debian/systemd/koha-es-indexer@.service @@ -17,6 +17,10 @@ Environment=PERL5LIB=/usr/share/koha/lib ExecStartPre=+/usr/sbin/koha-generate-env es-indexer %i EnvironmentFile=-/run/koha/%i/es-indexer.env ExecStart=/usr/share/koha/bin/workers/es_indexer_daemon.pl --batch_size ${ES_BATCH_SIZE} +ProtectSystem=full +ProtectHome=yes +PrivateTmp=yes +NoNewPrivileges=yes Restart=on-failure RestartSec=5s diff --git a/debian/systemd/koha-indexer@.service b/debian/systemd/koha-indexer@.service index 78c8b53f8c..a7655e3655 100644 --- a/debian/systemd/koha-indexer@.service +++ b/debian/systemd/koha-indexer@.service @@ -17,6 +17,10 @@ Environment=PERL5LIB=/usr/share/koha/lib ExecStartPre=+/usr/sbin/koha-generate-env indexer %i EnvironmentFile=-/run/koha/%i/indexer.env ExecStart=/usr/share/koha/bin/migration_tools/rebuild_zebra.pl -daemon -sleep ${INDEXER_TIMEOUT} +ProtectSystem=full +ProtectHome=yes +PrivateTmp=yes +NoNewPrivileges=yes Restart=on-failure RestartSec=30s diff --git a/debian/systemd/koha-plack@.service b/debian/systemd/koha-plack@.service index d0c82056e1..4ceffdf2cb 100644 --- a/debian/systemd/koha-plack@.service +++ b/debian/systemd/koha-plack@.service @@ -30,6 +30,10 @@ ExecStart=/usr/bin/starman \ --listen /var/run/koha/%i/plack.sock \ ${PLACK_PSGIFILE} ExecReload=/bin/kill -HUP $MAINPID +ProtectSystem=full +ProtectHome=yes +PrivateTmp=yes +NoNewPrivileges=yes Restart=on-failure RestartSec=5s diff --git a/debian/systemd/koha-sip@.service b/debian/systemd/koha-sip@.service index 1409d2905b..c2167af331 100644 --- a/debian/systemd/koha-sip@.service +++ b/debian/systemd/koha-sip@.service @@ -17,6 +17,10 @@ Environment=KOHA_CONF=/etc/koha/sites/%i/koha-conf.xml Environment=KOHA_HOME=/usr/share/koha Environment=PERL5LIB=/usr/share/koha/lib ExecStart=/usr/bin/perl /usr/share/koha/lib/C4/SIP/SIPServer.pm /etc/koha/sites/%i/SIPconfig.xml +ProtectSystem=full +ProtectHome=yes +PrivateTmp=yes +NoNewPrivileges=yes Restart=on-failure RestartSec=5s diff --git a/debian/systemd/koha-worker-long_tasks@.service b/debian/systemd/koha-worker-long_tasks@.service index 0593229c90..e58119e401 100644 --- a/debian/systemd/koha-worker-long_tasks@.service +++ b/debian/systemd/koha-worker-long_tasks@.service @@ -15,6 +15,10 @@ Environment=KOHA_CONF=/etc/koha/sites/%i/koha-conf.xml Environment=KOHA_HOME=/usr/share/koha Environment=PERL5LIB=/usr/share/koha/lib ExecStart=/usr/share/koha/bin/workers/background_jobs_worker.pl --queue long_tasks +ProtectSystem=full +ProtectHome=yes +PrivateTmp=yes +NoNewPrivileges=yes Restart=on-failure RestartSec=5s diff --git a/debian/systemd/koha-worker@.service b/debian/systemd/koha-worker@.service index 8534d633e1..fef0fee9cb 100644 --- a/debian/systemd/koha-worker@.service +++ b/debian/systemd/koha-worker@.service @@ -15,6 +15,10 @@ Environment=KOHA_CONF=/etc/koha/sites/%i/koha-conf.xml Environment=KOHA_HOME=/usr/share/koha Environment=PERL5LIB=/usr/share/koha/lib ExecStart=/usr/share/koha/bin/workers/background_jobs_worker.pl --queue default +ProtectSystem=full +ProtectHome=yes +PrivateTmp=yes +NoNewPrivileges=yes Restart=on-failure RestartSec=5s diff --git a/debian/systemd/koha-z3950@.service b/debian/systemd/koha-z3950@.service index 1313da2825..7758f484d1 100644 --- a/debian/systemd/koha-z3950@.service +++ b/debian/systemd/koha-z3950@.service @@ -25,6 +25,10 @@ ExecStart=/usr/share/koha/bin/z3950_responder.pl \ -D \ -d %i-koha-z3950 \ -l /var/log/koha/%i/z3950.log +ProtectSystem=full +ProtectHome=yes +PrivateTmp=yes +NoNewPrivileges=yes Restart=on-failure RestartSec=5s diff --git a/debian/systemd/koha-zebra@.service b/debian/systemd/koha-zebra@.service index 0d6bf55b91..7d1702adfa 100644 --- a/debian/systemd/koha-zebra@.service +++ b/debian/systemd/koha-zebra@.service @@ -25,6 +25,10 @@ ExecStart=/usr/bin/zebrasrv \ -m '%%FT%%T' \ -p /var/run/koha/%i/zebra.pid \ -D +ProtectSystem=full +ProtectHome=yes +PrivateTmp=yes +NoNewPrivileges=yes Restart=on-failure RestartSec=30s