RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-04-28 13:49:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

systemd: lock down more privileges

Browse Source 
Including:

        ProtectClock=true
        ProtectHostname=true
        ProtectKernelLogs=true
        RestrictSUIDSGID=true

Also, alphabetize [service] settings.

Finally, add some protections for
systemd/ceph-immutable-object-cache@.service.in present in our other
service files but not this one.

Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
This commit is contained in:
Patrick Donnelly 2020-05-09 14:41:47 -07:00
parent ba805463ec
commit 9a84d5a09b
No known key found for this signature in database
GPG Key ID: 3A2A7E25BEA8AADB
8 changed files with 96 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
systemd/ceph-fuse@.service.in
View File

@ -6,21 +6,25 @@ Conflicts=umount.target
PartOf=ceph-fuse.target PartOf=ceph-fuse.target
[Service] [Service]
EnvironmentFile=-@SYSTEMD_ENV_FILE@
Environment=CLUSTER=ceph Environment=CLUSTER=ceph
EnvironmentFile=-@SYSTEMD_ENV_FILE@
ExecStart=/usr/bin/ceph-fuse -f --cluster ${CLUSTER} %I ExecStart=/usr/bin/ceph-fuse -f --cluster ${CLUSTER} %I
LockPersonality=true LockPersonality=true
MemoryDenyWriteExecute=true MemoryDenyWriteExecute=true
NoNewPrivileges=true NoNewPrivileges=true
# ceph-fuse requires access to /dev fuse device # ceph-fuse requires access to /dev fuse device
PrivateDevices=no PrivateDevices=no
ProtectClock=true
ProtectControlGroups=true ProtectControlGroups=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true ProtectKernelModules=true
ProtectKernelTunables=true ProtectKernelTunables=true
TasksMax=infinity
Restart=on-failure Restart=on-failure
StartLimitInterval=30min RestrictSUIDSGID=true
StartLimitBurst=3 StartLimitBurst=3
StartLimitInterval=30min
TasksMax=infinity
[Install] [Install]
WantedBy=ceph-fuse.target WantedBy=ceph-fuse.target

22
systemd/ceph-immutable-object-cache@.service.in
View File

@ -5,20 +5,26 @@ Wants=network-online.target local-fs.target
PartOf=ceph-immutable-object-cache.target PartOf=ceph-immutable-object-cache.target
[Service] [Service]
LimitNOFILE=1048576
LimitNPROC=1048576
EnvironmentFile=-@SYSTEMD_ENV_FILE@
Environment=CLUSTER=ceph Environment=CLUSTER=ceph
ExecStart=/usr/bin/ceph-immutable-object-cache -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph EnvironmentFile=-@SYSTEMD_ENV_FILE@
ExecReload=/bin/kill -HUP $MAINPID ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/bin/ceph-immutable-object-cache -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=yes PrivateDevices=yes
ProtectHome=true
ProtectSystem=full
PrivateTmp=true PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=full
Restart=on-failure Restart=on-failure
StartLimitInterval=30min RestrictSUIDSGID=true
StartLimitBurst=3 StartLimitBurst=3
TasksMax=infinity
[Install] [Install]
WantedBy=ceph-immutable-object-cache.target WantedBy=ceph-immutable-object-cache.target

18
systemd/ceph-mds@.service.in
View File

@ -5,26 +5,30 @@ Wants=network-online.target local-fs.target time-sync.target
PartOf=ceph-mds.target PartOf=ceph-mds.target
[Service] [Service]
Environment=CLUSTER=ceph
EnvironmentFile=-@SYSTEMD_ENV_FILE@
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/bin/ceph-mds -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
LimitNOFILE=1048576 LimitNOFILE=1048576
LimitNPROC=1048576 LimitNPROC=1048576
EnvironmentFile=-@SYSTEMD_ENV_FILE@
Environment=CLUSTER=ceph
ExecStart=/usr/bin/ceph-mds -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
ExecReload=/bin/kill -HUP $MAINPID
LockPersonality=true LockPersonality=true
MemoryDenyWriteExecute=true MemoryDenyWriteExecute=true
NoNewPrivileges=true NoNewPrivileges=true
PrivateDevices=yes PrivateDevices=yes
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true ProtectControlGroups=true
ProtectHome=true ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true ProtectKernelModules=true
ProtectKernelTunables=true ProtectKernelTunables=true
ProtectSystem=full ProtectSystem=full
PrivateTmp=true
TasksMax=infinity
Restart=on-failure Restart=on-failure
StartLimitInterval=30min RestrictSUIDSGID=true
StartLimitBurst=3 StartLimitBurst=3
StartLimitInterval=30min
TasksMax=infinity
[Install] [Install]
WantedBy=ceph-mds.target WantedBy=ceph-mds.target

36
systemd/ceph-mgr@.service.in
View File

@ -5,30 +5,34 @@ Wants=network-online.target local-fs.target time-sync.target
PartOf=ceph-mgr.target PartOf=ceph-mgr.target
[Service] [Service]
Environment=CLUSTER=ceph
EnvironmentFile=-@SYSTEMD_ENV_FILE@
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/bin/ceph-mgr -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
LimitNOFILE=1048576 LimitNOFILE=1048576
LimitNPROC=1048576 LimitNPROC=1048576
EnvironmentFile=-@SYSTEMD_ENV_FILE@
Environment=CLUSTER=ceph
ExecStart=/usr/bin/ceph-mgr -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
ExecReload=/bin/kill -HUP $MAINPID
LockPersonality=true LockPersonality=true
NoNewPrivileges=true
PrivateDevices=yes
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=full
Restart=on-failure
RestartSec=10
RestrictSUIDSGID=true
StartLimitBurst=3
StartLimitInterval=30min
# We need to disable this protection as some python libraries generate # We need to disable this protection as some python libraries generate
# dynamic code, like python-cffi, and require mmap calls to succeed # dynamic code, like python-cffi, and require mmap calls to succeed
MemoryDenyWriteExecute=false MemoryDenyWriteExecute=false
NoNewPrivileges=true
PrivateDevices=yes
ProtectControlGroups=true
ProtectHome=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=full
PrivateTmp=true
Restart=on-failure
RestartSec=10
StartLimitInterval=30min
StartLimitBurst=3
[Install] [Install]
WantedBy=ceph-mgr.target WantedBy=ceph-mgr.target

21
systemd/ceph-mon@.service.in
View File

@ -7,32 +7,35 @@ Description=Ceph cluster monitor daemon
# configuration. # configuration.
After=network-online.target local-fs.target time-sync.target After=network-online.target local-fs.target time-sync.target
Wants=network-online.target local-fs.target time-sync.target Wants=network-online.target local-fs.target time-sync.target
PartOf=ceph-mon.target PartOf=ceph-mon.target
[Service] [Service]
Environment=CLUSTER=ceph
EnvironmentFile=-@SYSTEMD_ENV_FILE@
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/bin/ceph-mon -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
LimitNOFILE=1048576 LimitNOFILE=1048576
LimitNPROC=1048576 LimitNPROC=1048576
EnvironmentFile=-@SYSTEMD_ENV_FILE@
Environment=CLUSTER=ceph
ExecStart=/usr/bin/ceph-mon -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
ExecReload=/bin/kill -HUP $MAINPID
LockPersonality=true LockPersonality=true
MemoryDenyWriteExecute=true MemoryDenyWriteExecute=true
# Need NewPrivileges via `sudo smartctl` # Need NewPrivileges via `sudo smartctl`
NoNewPrivileges=false NoNewPrivileges=false
PrivateDevices=yes PrivateDevices=yes
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true ProtectControlGroups=true
ProtectHome=true ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true ProtectKernelModules=true
ProtectKernelTunables=true ProtectKernelTunables=true
ProtectSystem=full ProtectSystem=full
PrivateTmp=true
TasksMax=infinity
Restart=on-failure Restart=on-failure
StartLimitInterval=30min
StartLimitBurst=5
RestartSec=10 RestartSec=10
RestrictSUIDSGID=true
StartLimitBurst=5
StartLimitInterval=30min
TasksMax=infinity
[Install] [Install]
WantedBy=ceph-mon.target WantedBy=ceph-mon.target

20
systemd/ceph-osd@.service.in
View File

@ -5,29 +5,33 @@ Wants=network-online.target local-fs.target time-sync.target
PartOf=ceph-osd.target PartOf=ceph-osd.target
[Service] [Service]
LimitNOFILE=1048576
LimitNPROC=1048576
EnvironmentFile=-@SYSTEMD_ENV_FILE@
Environment=CLUSTER=ceph Environment=CLUSTER=ceph
EnvironmentFile=-@SYSTEMD_ENV_FILE@
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/bin/ceph-osd -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph ExecStart=/usr/bin/ceph-osd -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
ExecStartPre=/usr/lib/ceph/ceph-osd-prestart.sh --cluster ${CLUSTER} --id %i ExecStartPre=/usr/lib/ceph/ceph-osd-prestart.sh --cluster ${CLUSTER} --id %i
ExecReload=/bin/kill -HUP $MAINPID LimitNOFILE=1048576
LimitNPROC=1048576
LockPersonality=true LockPersonality=true
MemoryDenyWriteExecute=true MemoryDenyWriteExecute=true
# Need NewPrivileges via `sudo smartctl` # Need NewPrivileges via `sudo smartctl`
NoNewPrivileges=false NoNewPrivileges=false
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true ProtectControlGroups=true
ProtectHome=true ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true ProtectKernelModules=true
# flushing filestore requires access to /proc/sys/vm/drop_caches # flushing filestore requires access to /proc/sys/vm/drop_caches
ProtectKernelTunables=false ProtectKernelTunables=false
ProtectSystem=full ProtectSystem=full
PrivateTmp=true
TasksMax=infinity
Restart=on-failure Restart=on-failure
StartLimitInterval=30min
StartLimitBurst=3
RestartSec=10 RestartSec=10
RestrictSUIDSGID=true
StartLimitBurst=3
StartLimitInterval=30min
TasksMax=infinity
[Install] [Install]
WantedBy=ceph-osd.target WantedBy=ceph-osd.target

16
systemd/ceph-radosgw@.service.in
View File

@ -5,25 +5,29 @@ Wants=network-online.target local-fs.target time-sync.target
PartOf=ceph-radosgw.target PartOf=ceph-radosgw.target
[Service] [Service]
Environment=CLUSTER=ceph
EnvironmentFile=-@SYSTEMD_ENV_FILE@
ExecStart=/usr/bin/radosgw -f --cluster ${CLUSTER} --name client.%i --setuser ceph --setgroup ceph
LimitNOFILE=1048576 LimitNOFILE=1048576
LimitNPROC=1048576 LimitNPROC=1048576
EnvironmentFile=-@SYSTEMD_ENV_FILE@
Environment=CLUSTER=ceph
ExecStart=/usr/bin/radosgw -f --cluster ${CLUSTER} --name client.%i --setuser ceph --setgroup ceph
LockPersonality=true LockPersonality=true
MemoryDenyWriteExecute=true MemoryDenyWriteExecute=true
NoNewPrivileges=true NoNewPrivileges=true
PrivateDevices=yes PrivateDevices=yes
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true ProtectControlGroups=true
ProtectHome=true ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true ProtectKernelModules=true
ProtectKernelTunables=true ProtectKernelTunables=true
ProtectSystem=full ProtectSystem=full
PrivateTmp=true
TasksMax=infinity
Restart=on-failure Restart=on-failure
StartLimitInterval=30s RestrictSUIDSGID=true
StartLimitBurst=5 StartLimitBurst=5
StartLimitInterval=30s
TasksMax=infinity
[Install] [Install]
WantedBy=ceph-radosgw.target WantedBy=ceph-radosgw.target

16
systemd/ceph-rbd-mirror@.service.in
View File

@ -5,25 +5,29 @@ Wants=network-online.target local-fs.target
PartOf=ceph-rbd-mirror.target PartOf=ceph-rbd-mirror.target
[Service] [Service]
Environment=CLUSTER=ceph
EnvironmentFile=-@SYSTEMD_ENV_FILE@
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/bin/rbd-mirror -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
LimitNOFILE=1048576 LimitNOFILE=1048576
LimitNPROC=1048576 LimitNPROC=1048576
EnvironmentFile=-@SYSTEMD_ENV_FILE@
Environment=CLUSTER=ceph
ExecStart=/usr/bin/rbd-mirror -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
ExecReload=/bin/kill -HUP $MAINPID
LockPersonality=true LockPersonality=true
MemoryDenyWriteExecute=true MemoryDenyWriteExecute=true
NoNewPrivileges=true NoNewPrivileges=true
PrivateDevices=yes PrivateDevices=yes
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true ProtectControlGroups=true
ProtectHome=true ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true ProtectKernelModules=true
ProtectKernelTunables=true ProtectKernelTunables=true
ProtectSystem=full ProtectSystem=full
PrivateTmp=true
Restart=on-failure Restart=on-failure
StartLimitInterval=30min RestrictSUIDSGID=true
StartLimitBurst=3 StartLimitBurst=3
StartLimitInterval=30min
TasksMax=infinity TasksMax=infinity
[Install] [Install]