systemd: lock down systemctl status

Mitigates a security issue that allows unprivileged users to read other
unprivileged user's processes' credentials from CGroup using `systemctl
status`.
This commit is contained in:
nixbitcoin 2020-07-27 17:26:45 +00:00
parent 6e694890eb
commit 0248e6493f
No known key found for this signature in database
GPG Key ID: DD11F9AD5308B3BA
3 changed files with 59 additions and 0 deletions

55
modules/dbus.nix Normal file
View File

@ -0,0 +1,55 @@
{ config, lib, pkgs, ... }:
with lib;
let
inherit (config) nix-bitcoin-services;
dataDir = "/var/lib/dbus-hardening";
# Mitigates a security issue that allows unprivileged users to read
# other unprivileged user's processes' credentials from CGroup using
# `systemctl status`.
dbus-hardening = pkgs.writeText "dbus.conf" ''
<?xml version="1.0" encoding="UTF-8"?> <!-- -*- XML -*- -->
<!DOCTYPE busconfig PUBLIC
"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
<policy user="root">
<allow send_destination="org.freedesktop.systemd1"
send_interface="org.freedesktop.systemd1.Manager"
send_member="GetUnitProcesses"/>
</policy>
<policy context="mandatory">
<deny send_destination="org.freedesktop.systemd1"
send_interface="org.freedesktop.systemd1.Manager"
send_member="GetUnitProcesses"/>
</policy>
</busconfig>
'';
in {
config = {
systemd.tmpfiles.rules = [
"d '${dataDir}/etc/dbus-1/system.d' 0770 messagebus messagebus - -"
];
services.dbus.packages = [ "${dataDir}" ];
systemd.services.hardeneddbus = {
description = "Install hardeneddbus";
wantedBy = [ "multi-user.target" ];
script = ''
cp ${dbus-hardening} ${dataDir}/etc/dbus-1/system.d/dbus.conf
chmod 640 ${dataDir}/etc/dbus-1/system.d/dbus.conf
'';
serviceConfig = nix-bitcoin-services.defaultHardening // {
PrivateNetwork = "true";
Type = "oneshot";
User = "messagebus";
ReadWritePaths = "${dataDir}";
};
};
};
}

View File

@ -15,6 +15,7 @@
./lnd.nix ./lnd.nix
./secrets/secrets.nix ./secrets/secrets.nix
./netns-isolation.nix ./netns-isolation.nix
./dbus.nix
]; ];
disabledModules = [ "services/networking/bitcoind.nix" ]; disabledModules = [ "services/networking/bitcoind.nix" ];

View File

@ -42,6 +42,9 @@ in {
networking.firewall.enable = true; networking.firewall.enable = true;
# hideProcessInformation even if hardened kernel profile is disabled
security.hideProcessInformation = true;
# Tor # Tor
services.tor = { services.tor = {
enable = true; enable = true;