Skip to contentSkip to conversation

build: Always define confdir and statedir

PATCH In review Bastien Nocera 1 participant 5 messages Sep 20, 2017 – Nov 24, 2017

Subsystems (2)
Bluetooth drivers Kbuild
lore
Share & tools
lore

Bastien Nocera

author
#0 lore raw

PATCH 1/4 build: Always define confdir and statedir

As we will need those paths to lock down on them.

---
 Makefile.am | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
Makefile.am +3 -3
index 555f301ca..1c38d94e5 100644
@@ -30,14 +30,14 @@ include_HEADERS =
 AM_CFLAGS = $(WARNING_CFLAGS) $(MISC_CFLAGS)
 AM_LDFLAGS = $(MISC_LDFLAGS)
 
+confdir = $(sysconfdir)/bluetooth
+statedir = $(localstatedir)/lib/bluetooth
+
 if DATAFILES
 dbusdir = @DBUS_CONFDIR@/dbus-1/system.d
 dbus_DATA = src/bluetooth.conf
 
-confdir = $(sysconfdir)/bluetooth
 conf_DATA =
-
-statedir = $(localstatedir)/lib/bluetooth
 state_DATA =
 endif
Signature · 1 line
2.14.1
author
#1 lore raw

PATCH 2/4 systemd: Add PrivateTmp and NoNewPrivileges options

From: Craig Andrews <[email protected]>

PrivateTmp makes bluetoothd's /tmp and /var/tmp be inside a different namespace. This is useful to secure access to temporary files of the process.

NoNewPrivileges ensures that service process and all its children can never gain new privileges through execve(), lowering the risk of possible privilege escalations.

---
 src/bluetooth.service.in | 6 ++++++
 1 file changed, 6 insertions(+)
src/bluetooth.service.in +6 -0
index f799f65f0..a6f3030f9 100644
@@ -12,8 +12,14 @@ NotifyAccess=main
 #Restart=on-failure
 CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
 LimitNPROC=1
+
+# Filesystem lockdown
 ProtectHome=true
 ProtectSystem=full
+PrivateTmp=true
+
+# Privilege escalation
+NoNewPrivileges=true
 
 [Install]
 WantedBy=bluetooth.target
Signature · 1 line
2.14.1
author
#2 lore raw

PATCH 3/4 systemd: Add more filesystem lockdown

In reply to Bastien Nocera

We can only access the configuration file as read-only and read-write to the Bluetooth cache directory and sub-directories.

---
 Makefile.am              | 2 ++
 src/bluetooth.service.in | 4 ++++
 2 files changed, 6 insertions(+)
Makefile.am +2 -0
index 1c38d94e5..13ccf9079 100644
@@ -478,6 +478,8 @@ MAINTAINERCLEANFILES = Makefile.in \
 
 SED_PROCESS = $(AM_V_GEN)$(MKDIR_P) $(dir $@) && \
 		$(SED) -e 's,@libexecdir\@,$(libexecdir),g' \
+		       -e 's,@statedir\@,$(statedir),g' \
+		       -e 's,@confdir\@,$(confdir),g' \
 		< $< > $@
 
 %.service: %.service.in Makefile
src/bluetooth.service.in +4 -0
index a6f3030f9..7e55b5043 100644
@@ -17,6 +17,10 @@ LimitNPROC=1
 ProtectHome=true
 ProtectSystem=full
 PrivateTmp=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+ReadWritePaths=@statedir@
+ReadOnlyPaths=@confdir@
 
 # Privilege escalation
 NoNewPrivileges=true
Signature · 1 line
2.14.1
author
#3 lore raw

PATCH 4/4 systemd: More lockdown

In reply to Bastien Nocera

bluetoothd does not need to execute mapped memory, or real-time access, so block those.

---
 src/bluetooth.service.in | 6 ++++++
 1 file changed, 6 insertions(+)
src/bluetooth.service.in +6 -0
index 7e55b5043..e8267b338 100644
@@ -22,9 +22,15 @@ ProtectControlGroups=true
 ReadWritePaths=@statedir@
 ReadOnlyPaths=@confdir@
 
+# Execute Mappings
+MemoryDenyWriteExecute=true
+
 # Privilege escalation
 NoNewPrivileges=true
 
+# Real-time
+RestrictRealtime=true
+
 [Install]
 WantedBy=bluetooth.target
 Alias=dbus-org.bluez.service
Signature · 1 line
2.14.1
author
#4 lore raw
In reply to Bastien Nocera
Quoted 1 line · Bastien Nocera

As we will need those paths to lock down on them.

The 4 patches in this patchset are still relevant.

NoNewPrivileges broke SELinux on Fedora, but the problem has since been fixed in the kernel SELinux support to handle it properly.

Cheers