Whilst rngd has to run as root, we can significantly constrain its
permissions (network is only required if nistbeacon is enabled).
Signed-off-by: Alex Kiernan <alex.kier...@gmail.com>
---
Changes in v2:
- fix network access
.../rng-tools/rng-tools/rngd.service | 19 +++++++++++++++++++
.../rng-tools/rng-tools_6.9.bb | 7 +++++++
2 files changed, 26 insertions(+)
diff --git a/meta/recipes-support/rng-tools/rng-tools/rngd.service
b/meta/recipes-support/rng-tools/rng-tools/rngd.service
index 084322ac40aa..0559b9799154 100644
--- a/meta/recipes-support/rng-tools/rng-tools/rngd.service
+++ b/meta/recipes-support/rng-tools/rng-tools/rngd.service
@@ -8,6 +8,25 @@ Conflicts=shutdown.target
[Service]
EnvironmentFile=-@SYSCONFDIR@/default/rng-tools
ExecStart=@SBINDIR@/rngd -f $EXTRA_ARGS
+CapabilityBoundingSet=CAP_SYS_ADMIN
+IPAddressDeny=any
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=@system-service
[Install]
WantedBy=sysinit.target
diff --git a/meta/recipes-support/rng-tools/rng-tools_6.9.bb
b/meta/recipes-support/rng-tools/rng-tools_6.9.bb
index 913342c315de..8c98a9aa3ae2 100644
--- a/meta/recipes-support/rng-tools/rng-tools_6.9.bb
+++ b/meta/recipes-support/rng-tools/rng-tools_6.9.bb
@@ -49,4 +49,11 @@ do_install_append() {
-e 's,@SBINDIR@,${sbindir},g' \
${D}${sysconfdir}/init.d/rng-tools \
${D}${systemd_system_unitdir}/rngd.service
+
+ if [ "${@bb.utils.contains('PACKAGECONFIG', 'nistbeacon', 'yes', 'no',
d)}" = "yes" ]; then
+ sed -i \
+ -e '/^IPAddressDeny=any/d' \
+ -e '/^RestrictAddressFamilies=/ s/$/ AF_INET AF_INET6/' \
+ ${D}${systemd_system_unitdir}/rngd.service
+ fi
}
--
2.17.1
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#137413):
https://lists.openembedded.org/g/openembedded-core/message/137413
Mute This Topic: https://lists.openembedded.org/mt/73215914/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
