From 7a10478ea7b992ffa1f19f389e53df0fe2aa936d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 16 May 2021 18:27:10 +0200 Subject: [PATCH 1/2] nixos/acme: harden systemd units --- nixos/modules/security/acme.nix | 52 ++++++++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 8 deletions(-) diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix index 22bf34198a3..bcbd17d8e10 100644 --- a/nixos/modules/security/acme.nix +++ b/nixos/modules/security/acme.nix @@ -21,15 +21,51 @@ let # The Group can vary depending on what the user has specified in # security.acme.certs..group on some of the services. commonServiceConfig = { - Type = "oneshot"; - User = "acme"; - Group = mkDefault "acme"; - UMask = 0022; - StateDirectoryMode = 750; - ProtectSystem = "full"; - PrivateTmp = true; + Type = "oneshot"; + User = "acme"; + Group = mkDefault "acme"; + UMask = 0022; + StateDirectoryMode = 750; + ProtectSystem = "strict"; + ReadWritePaths = [ + "/var/lib/acme" + ]; + PrivateTmp = true; - WorkingDirectory = "/tmp"; + WorkingDirectory = "/tmp"; + + CapabilityBoundingSet = [ "" ]; + DevicePolicy = "closed"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + ProtectClock = true; + ProtectHome = true; + ProtectHostname = true; + ProtectControlGroups = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProcSubset = "pid"; + RemoveIPC = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ + # 1. allow a reasonable set of syscalls + "@system-service" + # 2. and deny unreasonable ones + "~@privileged @resources" + # 3. then allow the required subset within denied groups + "@chown" + ]; }; # In order to avoid race conditions creating the CA for selfsigned certs, From eba6713e8f47b4f50374f8bf27034a3bc2826514 Mon Sep 17 00:00:00 2001 From: Lucas Savva Date: Sat, 22 May 2021 18:58:24 +0200 Subject: [PATCH 2/2] nixos/tests/acme: test access to files outside /var/lib/acme in postRun --- nixos/tests/acme.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix index 6532fc4ac1d..72b7bb8a396 100644 --- a/nixos/tests/acme.nix +++ b/nixos/tests/acme.nix @@ -105,9 +105,9 @@ in import ./make-test-python.nix ({ lib, ... }: { security.acme.certs."a.example.test".keyType = "ec384"; security.acme.certs."a.example.test".postRun = '' set -euo pipefail - touch test - chown root:root test - echo testing > test + touch /home/test + chown root:root /home/test + echo testing > /home/test ''; }; @@ -383,7 +383,7 @@ in import ./make-test-python.nix ({ lib, ... }: { switch_to(webserver, "cert-change") webserver.wait_for_unit("acme-finished-a.example.test.target") check_connection_key_bits(client, "a.example.test", "384") - webserver.succeed("grep testing /var/lib/acme/a.example.test/test") + webserver.succeed("grep testing /home/test") # Clean to remove the testing file (and anything else messy we did) webserver.succeed("systemctl clean acme-a.example.test.service --what=state")