b5000b8869
I think the following systemd security measures are safe for Koha: ProtectSystem=full Sets /usr & /boot to read-only ProtectHome=yes Hides /home, /root and /run/user NOTE: The hiding of /run/user through me off, but google says it's only for interactive logins only. AFAIK the only thing that does that is koha-shell which isn't a systemd thing so it is unaffected PrivateTmp=yes Private /tmp & /var/tmp NOTE: AFACT nothing in Koha shares files via /tmp which feels like it would be a bad thing to do anyway NoNewPrivileges=yes setuid binaries can't re-elevate NOTE: This feels like the most important one! Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk> |
||
|---|---|---|
| .. | ||
| koha-common.service | ||
| koha-create-dirs@.service | ||
| koha-es-indexer@.service | ||
| koha-indexer@.service | ||
| koha-plack@.service | ||
| koha-sip@.service | ||
| koha-systemd-ctl | ||
| koha-worker-long_tasks@.service | ||
| koha-worker@.service | ||
| koha-z3950@.service | ||
| koha-zebra@.service | ||
| koha.target | ||
| koha@.target | ||