follow-up netlink support, systemd integration

RFC New Christian Hesse 1 participant 4 messages Apr 1, 2018

Share & tools

Christian Hesse

author

2018-04-01 19:13 UTC #0 lore raw

cover follow-up netlink support, systemd integration

This series is a follow-up to 'add netlink support for Linux' by Antonio Quartulli. It enhances integration with systemd and improves system security by running the openvpn process with a dedicated user.

Christian Hesse (3):
systemd: run openvpn with dedicated user
systemd: do not downgrade UID/GID
systemd: create configuration directories from tmpfiles

 configure.ac                              | 8 ++++++++
 distro/systemd/Makefile.am                | 4 ++++
 distro/systemd/[email protected]... | 4 +++-
 distro/systemd/[email protected]... | 4 +++-
 distro/systemd/sysusers-openvpn.conf      | 1 +
 distro/systemd/tmpfiles-openvpn.conf      | 6 ++++--
 src/openvpn/init.c                        | 8 ++++++++
 7 files changed, 31 insertions(+), 4 deletions(-)

Christian Hesse

author

2018-04-01 19:13 UTC #1 lore raw

RFC 1/3 systemd: run openvpn with dedicated user

From: Christian Hesse <[email protected]...>

Now that we have a native netlink interface run the process with dedicated user 'openvpn'. This is possibly by granting ambient capabilities, see systemd.exec(5).

Signed-off-by Christian Hesse <[email protected]...>

---
 configure.ac                              | 8 ++++++++
 distro/systemd/Makefile.am                | 4 ++++
 distro/systemd/[email protected]... | 4 +++-
 distro/systemd/[email protected]... | 4 +++-
 distro/systemd/sysusers-openvpn.conf      | 1 +
 distro/systemd/tmpfiles-openvpn.conf      | 4 ++--
 6 files changed, 21 insertions(+), 4 deletions(-)
 create mode 100644 distro/systemd/sysusers-openvpn.conf

configure.ac +8 -0

index f2e4aa47..3d9d2ed5 100644
@@ -365,6 +365,7 @@ AC_ARG_VAR([GIT], [path to git utility])
 AC_ARG_VAR([SYSTEMD_ASK_PASSWORD], [path to systemd-ask-password utility])
 AC_ARG_VAR([SYSTEMD_UNIT_DIR], [Path of systemd unit directory @<:@default=LIBDIR/systemd/system@:>@])
 AC_ARG_VAR([TMPFILES_DIR], [Path of tmpfiles directory @<:@default=LIBDIR/tmpfiles.d@:>@])
+AC_ARG_VAR([SYSUSERS_DIR], [Path of sysusers directory @<:@default=LIBDIR/sysusers.d@:>@])
 AC_PATH_PROGS([IFCONFIG], [ifconfig],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin])
 AC_PATH_PROGS([ROUTE], [route],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin])
 AC_PATH_PROGS([IPROUTE], [ip],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin])

@@ -1198,6 +1199,12 @@ if test "$enable_systemd" = "yes" ; then
     else
         tmpfilesdir="\${libdir}/tmpfiles.d"
     fi
+
+    if test -n "${SYSUSERS_DIR}"; then
+        sysusersdir="${SYSUSERS_DIR}"
+    else
+        sysusersdir="\${libdir}/sysusers.d"
+    fi
 fi

@@ -1381,6 +1388,7 @@ AC_SUBST([sampledir])
 
 AC_SUBST([systemdunitdir])
 AC_SUBST([tmpfilesdir])
+AC_SUBST([sysusersdir])
 
 VENDOR_SRC_ROOT="\$(abs_top_srcdir)/vendor/"
 VENDOR_DIST_ROOT="\$(abs_top_builddir)/vendor/dist"

distro/systemd/Makefile.am +4 -0

index 69e12699..2641a63d 100644
@@ -14,6 +14,7 @@
 
 EXTRA_DIST = \
 	tmpfiles-openvpn.conf \
+	sysusers-openvpn.conf \
 	[email protected]... \
 	[email protected]...

@@ -23,11 +24,14 @@ systemdunit_DATA = \
 	[email protected]...
 tmpfiles_DATA = \
 	tmpfiles-openvpn.conf
+sysusers_DATA = \
+	sysusers-openvpn.conf
 dist_doc_DATA = \
 	README.systemd
 
 install-data-hook:
 	mv $(DESTDIR)$(tmpfilesdir)/tmpfiles-openvpn.conf $(DESTDIR)$(tmpfilesdir)/openvpn.conf
+	mv $(DESTDIR)$(sysusersdir)/sysusers-openvpn.conf $(DESTDIR)$(sysusersdir)/openvpn.conf
 endif
 
 MAINTAINERCLEANFILES = \

distro/systemd/[email protected]... +3 -1

index cbcef653..a103d751 100644
@@ -9,9 +9,11 @@ Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
 [Service]
 Type=notify
 PrivateTmp=true
+User=openvpn
+Group=openvpn
 WorkingDirectory=/etc/openvpn/client
 ExecStart=@sbindir@/openvpn --suppress-timestamps --nobind --config %i.conf
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
+AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
 LimitNPROC=10
 DeviceAllow=/dev/null rw
 DeviceAllow=/dev/net/tun rw

distro/systemd/[email protected]... +3 -1

index a8366a04..7275e86a 100644
@@ -9,9 +9,11 @@ Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
 [Service]
 Type=notify
 PrivateTmp=true
+User=openvpn
+Group=openvpn
 WorkingDirectory=/etc/openvpn/server
 ExecStart=@sbindir@/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
+AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
 LimitNPROC=10
 DeviceAllow=/dev/null rw
 DeviceAllow=/dev/net/tun rw

distro/systemd/sysusers-openvpn.conf new file +1 -0

new file mode 100644
index 00000000..d200852b
@@ -0,0 +1 @@
+u openvpn - "OpenVPN user" /

distro/systemd/tmpfiles-openvpn.conf +2 -2

index bb79671e..835dc1c8 100644
@@ -1,2 +1,2 @@
-d /run/openvpn-client 0710 root root -
-d /run/openvpn-server 0710 root root -
+d /run/openvpn-client 0750 openvpn openvpn -
+d /run/openvpn-server 0750 openvpn openvpn -

Christian Hesse

author

2018-04-01 19:13 UTC #2 lore raw

RFC 2/3 systemd: do not downgrade UID/GID

In reply to Christian Hesse

From: Christian Hesse <[email protected]...>

Now that systemd starts the process with dedicated user we do no longer want to downgrade privileges. Also remove CAP_SETGID and CAP_SETUID from granted privileges.

Signed-off-by Christian Hesse <[email protected]...>

---
 distro/systemd/[email protected]... | 2 +-
 distro/systemd/[email protected]... | 2 +-
 src/openvpn/init.c                        | 8 ++++++++
 3 files changed, 10 insertions(+), 2 deletions(-)

distro/systemd/[email protected]... +1 -1

index a103d751..ee7957a6 100644
@@ -13,7 +13,7 @@ User=openvpn
 Group=openvpn
 WorkingDirectory=/etc/openvpn/client
 ExecStart=@sbindir@/openvpn --suppress-timestamps --nobind --config %i.conf
-AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
+AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_CHROOT CAP_DAC_OVERRIDE
 LimitNPROC=10
 DeviceAllow=/dev/null rw
 DeviceAllow=/dev/net/tun rw

distro/systemd/[email protected]... +1 -1

index 7275e86a..03d28a2e 100644
@@ -13,7 +13,7 @@ User=openvpn
 Group=openvpn
 WorkingDirectory=/etc/openvpn/server
 ExecStart=@sbindir@/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
-AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
+AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SYS_CHROOT CAP_DAC_OVERRIDE
 LimitNPROC=10
 DeviceAllow=/dev/null rw
 DeviceAllow=/dev/net/tun rw

src/openvpn/init.c +8 -0

index 36c1a4c4..0fc60d62 100644
@@ -1151,6 +1151,14 @@ do_uid_gid_chroot(struct context *c, bool no_delay)
         /* set user and/or group if we want to setuid/setgid */
         if (c0->uid_gid_specified)
         {
+#ifdef ENABLE_SYSTEMD
+            if (sd_notify(0, "READY=0") > 0 && getuid() != 0)
+            {
+                msg(M_INFO, "NOTE: Running from systemd with non-root uid, skipping downgrade");
+                return;
+            }
+#endif
+
             if (no_delay)
             {
                 platform_group_set(&c0->platform_state_group);

Christian Hesse

author

2018-04-01 19:13 UTC #3 lore raw

RFC 3/3 systemd: create configuration directories from tmpfiles

In reply to Christian Hesse

From: Christian Hesse <[email protected]...>

We have a dedicated user created by systemd-sysusers, so create configuration directories from systemd-tmpfiles for proper permissions. This mitigates a race condition at packaging/install time.

Signed-off-by Christian Hesse <[email protected]...>

---
 distro/systemd/tmpfiles-openvpn.conf | 2 ++
 1 file changed, 2 insertions(+)

distro/systemd/tmpfiles-openvpn.conf +2 -0

index 835dc1c8..0f96baa5 100644
@@ -1,2 +1,4 @@
 d /run/openvpn-client 0750 openvpn openvpn -
 d /run/openvpn-server 0750 openvpn openvpn -
+d /etc/openvpn/client 0750 openvpn openvpn -
+d /etc/openvpn/server 0750 openvpn openvpn -