Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.

Commit 0d754ef

Browse files
savyajhasavyajha
committed
Added some hardening measures to systemd unit files for managing the matrix-synapse service
1 parent d9bd181 commit 0d754ef

File tree

3 files changed

+213
-0
lines changed

3 files changed

+213
-0
lines changed

‎debian/matrix-synapse.service

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,76 @@ Restart=always
1313
RestartSec=3
1414
SyslogIdentifier=matrix-synapse
1515

16+
# The following directives give the synapse service R/W access to:
17+
# - /run/matrix-synapse
18+
# - /var/lib/matrix-synapse
19+
# - /var/log/matrix-synapse
20+
21+
RuntimeDirectory=matrix-synapse
22+
StateDirectory=matrix-synapse
23+
LogsDirectory=matrix-synapse
24+
25+
######################
26+
## Security Sandbox ##
27+
######################
28+
29+
# Make sure that the service has its own unshared tmpfs at /tmp and that it
30+
# cannot see or change any real devices
31+
PrivateTmp=true
32+
PrivateDevices=true
33+
34+
# We give no capabilities to a service by default
35+
CapabilityBoundingSet=
36+
AmbientCapabilities=
37+
38+
# Protect the following from modification:
39+
# - The entire filesystem
40+
# - sysctl settings and loaded kernel modules
41+
# - No modifications allowed to Control Groups
42+
# - Hostname
43+
# - System Clock
44+
ProtectSystem=strict
45+
ProtectKernelTunables=true
46+
ProtectKernelModules=true
47+
ProtectControlGroups=true
48+
ProtectClock=true
49+
ProtectHostname=true
50+
51+
# Prevent access to the following:
52+
# - /home directory
53+
# - Kernel logs
54+
ProtectHome=tmpfs
55+
ProtectKernelLogs=true
56+
57+
# Make sure that the process can only see PIDs and process details of itself,
58+
# and the second option disables seeing details of things like system load and
59+
# I/O etc
60+
ProtectProc=invisible
61+
ProcSubset=pid
62+
63+
# While not needed, we set these options explicitly
64+
# - This process has been given access to the host network
65+
# - It can also communicate with any IP Address
66+
PrivateNetwork=false
67+
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
68+
IPAddressAllow=any
69+
70+
# Restrict system calls to a sane bunch
71+
SystemCallArchitectures=native
72+
SystemCallFilter=@system-service
73+
SystemCallFilter=~@privileged @resources @obsolete
74+
75+
# Misc restrictions
76+
# - Since the process is a python process it needs to be able to write and
77+
# execute memory regions, so we set MemoryDenyWriteExecute to false
78+
RestrictSUIDSGID=true
79+
RemoveIPC=true
80+
NoNewPrivileges=true
81+
RestrictRealtime=true
82+
RestrictNamespaces=true
83+
LockPersonality=true
84+
PrivateUsers=true
85+
MemoryDenyWriteExecute=false
86+
1687
[Install]
1788
WantedBy=multi-user.target

‎docs/systemd-with-workers/system/[email protected]

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,76 @@ Restart=always
2222
RestartSec=3
2323
SyslogIdentifier=matrix-synapse-%i
2424

25+
# The following directives give the synapse worker service R/W access to:
26+
# - /run/matrix-synapse
27+
# - /var/lib/matrix-synapse
28+
# - /var/log/matrix-synapse
29+
30+
RuntimeDirectory=matrix-synapse
31+
StateDirectory=matrix-synapse
32+
LogsDirectory=matrix-synapse
33+
34+
######################
35+
## Security Sandbox ##
36+
######################
37+
38+
# Make sure that the service has its own unshared tmpfs at /tmp and that it
39+
# cannot see or change any real devices
40+
PrivateTmp=true
41+
PrivateDevices=true
42+
43+
# We give no capabilities to a service by default
44+
CapabilityBoundingSet=
45+
AmbientCapabilities=
46+
47+
# Protect the following from modification:
48+
# - The entire filesystem
49+
# - sysctl settings and loaded kernel modules
50+
# - No modifications allowed to Control Groups
51+
# - Hostname
52+
# - System Clock
53+
ProtectSystem=strict
54+
ProtectKernelTunables=true
55+
ProtectKernelModules=true
56+
ProtectControlGroups=true
57+
ProtectClock=true
58+
ProtectHostname=true
59+
60+
# Prevent access to the following:
61+
# - /home directory
62+
# - Kernel logs
63+
ProtectHome=tmpfs
64+
ProtectKernelLogs=true
65+
66+
# Make sure that the process can only see PIDs and process details of itself,
67+
# and the second option disables seeing details of things like system load and
68+
# I/O etc
69+
ProtectProc=invisible
70+
ProcSubset=pid
71+
72+
# While not needed, we set these options explicitly
73+
# - This process has been given access to the host network
74+
# - It can also communicate with any IP Address
75+
PrivateNetwork=false
76+
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
77+
IPAddressAllow=any
78+
79+
# Restrict system calls to a sane bunch
80+
SystemCallArchitectures=native
81+
SystemCallFilter=@system-service
82+
SystemCallFilter=~@privileged @resources @obsolete
83+
84+
# Misc restrictions
85+
# - Since the process is a python process it needs to be able to write and
86+
# execute memory regions
87+
RestrictSUIDSGID=true
88+
RemoveIPC=true
89+
NoNewPrivileges=true
90+
RestrictRealtime=true
91+
RestrictNamespaces=true
92+
LockPersonality=true
93+
PrivateUsers=true
94+
MemoryDenyWriteExecute=false
95+
2596
[Install]
2697
WantedBy=matrix-synapse.target

‎docs/systemd-with-workers/system/matrix-synapse.service

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,76 @@ Restart=always
1818
RestartSec=3
1919
SyslogIdentifier=matrix-synapse
2020

21+
# The following directives give the synapse service R/W access to:
22+
# - /run/matrix-synapse
23+
# - /var/lib/matrix-synapse
24+
# - /var/log/matrix-synapse
25+
26+
RuntimeDirectory=matrix-synapse
27+
StateDirectory=matrix-synapse
28+
LogsDirectory=matrix-synapse
29+
30+
######################
31+
## Security Sandbox ##
32+
######################
33+
34+
# Make sure that the service has its own unshared tmpfs at /tmp and that it
35+
# cannot see or change any real devices
36+
PrivateTmp=true
37+
PrivateDevices=true
38+
39+
# We give no capabilities to a service by default
40+
CapabilityBoundingSet=
41+
AmbientCapabilities=
42+
43+
# Protect the following from modification:
44+
# - The entire filesystem
45+
# - sysctl settings and loaded kernel modules
46+
# - No modifications allowed to Control Groups
47+
# - Hostname
48+
# - System Clock
49+
ProtectSystem=strict
50+
ProtectKernelTunables=true
51+
ProtectKernelModules=true
52+
ProtectControlGroups=true
53+
ProtectClock=true
54+
ProtectHostname=true
55+
56+
# Prevent access to the following:
57+
# - /home directory
58+
# - Kernel logs
59+
ProtectHome=tmpfs
60+
ProtectKernelLogs=true
61+
62+
# Make sure that the process can only see PIDs and process details of itself,
63+
# and the second option disables seeing details of things like system load and
64+
# I/O etc
65+
ProtectProc=invisible
66+
ProcSubset=pid
67+
68+
# While not needed, we set these options explicitly
69+
# - This process has been given access to the host network
70+
# - It can also communicate with any IP Address
71+
PrivateNetwork=false
72+
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
73+
IPAddressAllow=any
74+
75+
# Restrict system calls to a sane bunch
76+
SystemCallArchitectures=native
77+
SystemCallFilter=@system-service
78+
SystemCallFilter=~@privileged @resources @obsolete
79+
80+
# Misc restrictions
81+
# - Since the process is a python process it needs to be able to write and
82+
# execute memory regions
83+
RestrictSUIDSGID=true
84+
RemoveIPC=true
85+
NoNewPrivileges=true
86+
RestrictRealtime=true
87+
RestrictNamespaces=true
88+
LockPersonality=true
89+
PrivateUsers=true
90+
MemoryDenyWriteExecute=false
91+
2192
[Install]
2293
WantedBy=matrix-synapse.target

0 commit comments

Comments
 (0)