Whilst rngd has to run as root, we can significantly constrain its permissions (AF_INET AF_INET6 are only required if nistbeacon is enabled).
Signed-off-by: Alex Kiernan <[email protected]> --- .../rng-tools/rng-tools/rngd.service | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/meta/recipes-support/rng-tools/rng-tools/rngd.service b/meta/recipes-support/rng-tools/rng-tools/rngd.service index 084322ac40aa..604e9500665e 100644 --- a/meta/recipes-support/rng-tools/rng-tools/rngd.service +++ b/meta/recipes-support/rng-tools/rng-tools/rngd.service @@ -8,6 +8,25 @@ Conflicts=shutdown.target [Service] EnvironmentFile=-@SYSCONFDIR@/default/rng-tools ExecStart=@SBINDIR@/rngd -f $EXTRA_ARGS +CapabilityBoundingSet=CAP_SYS_ADMIN +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelModules=yes +ProtectKernelLogs=yes +ProtectSystem=strict +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service [Install] WantedBy=sysinit.target -- 2.17.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#137382): https://lists.openembedded.org/g/openembedded-core/message/137382 Mute This Topic: https://lists.openembedded.org/mt/73195921/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
