b5000b8869
I think the following systemd security measures are safe for Koha: ProtectSystem=full Sets /usr & /boot to read-only ProtectHome=yes Hides /home, /root and /run/user NOTE: The hiding of /run/user through me off, but google says it's only for interactive logins only. AFAIK the only thing that does that is koha-shell which isn't a systemd thing so it is unaffected PrivateTmp=yes Private /tmp & /var/tmp NOTE: AFACT nothing in Koha shares files via /tmp which feels like it would be a bad thing to do anyway NoNewPrivileges=yes setuid binaries can't re-elevate NOTE: This feels like the most important one! Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk> |
||
|---|---|---|
| .. | ||
| docs | ||
| scripts | ||
| source | ||
| systemd | ||
| templates | ||
| README.build | ||
| bd-to-depends | ||
| build-git-snapshot | ||
| changelog | ||
| clean | ||
| compat | ||
| control | ||
| control.in | ||
| copyright | ||
| koha-common.README.Debian | ||
| koha-common.docs | ||
| koha-common.postinst | ||
| koha-common.preinst | ||
| koha-common.templates | ||
| koha-core.bash-completion | ||
| koha-core.config | ||
| koha-core.cron.d | ||
| koha-core.cron.daily | ||
| koha-core.cron.hourly | ||
| koha-core.cron.monthly | ||
| koha-core.default | ||
| koha-core.dirs | ||
| koha-core.docs | ||
| koha-core.install | ||
| koha-core.links | ||
| koha-core.logrotate | ||
| koha-core.postinst | ||
| koha-core.preinst | ||
| koha-core.templates | ||
| koha-full.postinst | ||
| koha-post-install-setup | ||
| koha-systemd.README.Debian | ||
| koha-systemd.dirs | ||
| koha-systemd.install | ||
| koha-systemd.postinst | ||
| koha-systemd.prerm | ||
| koha-sysv.init | ||
| koha-sysv.install | ||
| koha-sysv.postinst | ||
| koha-sysv.postrm | ||
| koha-sysv.prerm | ||
| koha-sysv.service | ||
| koha.README.Debian | ||
| koha.apache-ports | ||
| koha.config | ||
| koha.dirs | ||
| koha.install | ||
| koha.postinst | ||
| koha.postrm | ||
| koha.prerm | ||
| list-deps | ||
| rules | ||
| unavailable.html | ||
| update-control | ||
README.build
In order to build .deb packages, following debian packages need to be present (installed): devscripts pbuilder dh-make fakeroot As root (or sudo) execute: pbuilder create Executing build-git-snapshot without any arguments will leave package and the rest in some pbuilder dir, eg. /var/cache/pbuilder/result It is highly recommended that --buildresult option is used.