fix: enhance service security with systemd hardening #206
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
TAG Bot New tag: 1.0.38 |
fly602
force-pushed
the
master
branch
2 times, most recently
from
9604bb7 to
96c5212
Compare
deepin pr auto review我来对这个 systemd 服务单元文件的修改进行审查：
高优先级配置（已启用）：
中等优先级配置（已启用）：
其他配置：
a) 建议添加以下配置： # 限制文件系统访问
ProtectHome=yes
ProtectSystem=strict
ReadWritePaths=/tmp/deepin-update-ui
# 限制网络访问
# 如果不需要网络访问，可以添加：
# PrivateNetwork=yes
# 限制系统调用
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERMb) 建议添加服务超时限制： TimeoutStartSec=5min
TimeoutStopSec=30sc) 建议添加资源限制： MemoryMax=100M
TasksMax=100
这些改进将进一步提高服务的安全性，同时保持必要的功能可用性。建议在测试环境验证所有配置后再部署到生产环境。 |
Added comprehensive security hardening options to the deepin-update- [email protected] systemd unit file. The changes are organized in three phases based on priority and potential impact. Phase 1 includes high- priority security configurations that can be implemented immediately, such as protecting kernel tunables, clock settings, and restricting SUID/SGID binaries. Phase 2 contains medium-priority configurations that require testing before full implementation. Phase 3 includes additional security measures with some options commented out due to specific service requirements, like accessing /tmp/deepin-update-ui and D-Bus communication needs. These security enhancements are necessary to reduce the attack surface and improve the overall security posture of the update log copy service by restricting privileges, protecting system resources, and limiting potential exploitation vectors. Log: Enhanced security hardening for update log copy service Influence: 1. Test update log copying functionality to ensure it works with new security restrictions 2. Verify service can still access required resources like /tmp/deepin- update-ui 3. Confirm D-Bus communication remains functional with restricted address families 4. Check that kernel module and tunable protections don't interfere with normal operations 5. Validate that real-time scheduling restrictions don't impact performance 6. Test service behavior with private devices and IPC namespaces fix: 增强 systemd 服务安全加固 为 [email protected] systemd 单元文件添加了全面的安全加固 选项。这些更改按优先级和潜在影响分为三个阶段。第一阶段包含可立即实施的 高优先级安全配置，如保护内核可调参数、时钟设置和限制 SUID/SGID 二进制文 件。第二阶段包含需要测试后才能完全实施的中等优先级配置。第三阶段包含额 外的安全措施，其中一些选项因特定服务需求而被注释掉，例如需要访问 /tmp/ deepin-update-ui 和 D-Bus 通信需求。 这些安全增强对于减少攻击面、通过限制权限、保护系统资源和限制潜在利用向量 来提高更新日志复制服务的整体安全态势是必要的。 Log: 增强更新日志复制服务的安全加固 Influence: 1. 测试更新日志复制功能，确保在新安全限制下正常工作 2. 验证服务仍能访问所需资源，如 /tmp/deepin-update-ui 3. 确认在受限地址族情况下 D-Bus 通信仍能正常进行 4. 检查内核模块和可调参数保护是否干扰正常操作 5. 验证实时调度限制是否影响性能 6. 测试服务在私有设备和 IPC 命名空间下的行为
mhduiy
approved these changes
Jan 6, 2026
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fly602, mhduiy The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
TAG Bot New tag: 1.0.39 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fix: enhance systemd service security hardening
Added comprehensive security hardening options to the deepin-update-
[email protected] systemd unit file. The changes are organized in three
phases based on priority and potential impact. Phase 1 includes high-
priority security configurations that can be implemented immediately,
such as protecting kernel tunables, clock settings, and restricting
SUID/SGID binaries. Phase 2 contains medium-priority configurations that
require testing before full implementation. Phase 3 includes additional
security measures with some options commented out due to specific
service requirements, like accessing /tmp/deepin-update-ui and D-Bus
communication needs.
These security enhancements are necessary to reduce the attack surface
and improve the overall security posture of the update log copy service
by restricting privileges, protecting system resources, and limiting
potential exploitation vectors.
Log: Enhanced security hardening for update log copy service
Influence:
security restrictions
update-ui
address families
normal operations
performance
fix: 增强 systemd 服务安全加固
为 [email protected] systemd 单元文件添加了全面的安全加固
选项。这些更改按优先级和潜在影响分为三个阶段。第一阶段包含可立即实施的
高优先级安全配置，如保护内核可调参数、时钟设置和限制 SUID/SGID 二进制文
件。第二阶段包含需要测试后才能完全实施的中等优先级配置。第三阶段包含额
外的安全措施，其中一些选项因特定服务需求而被注释掉，例如需要访问 /tmp/
deepin-update-ui 和 D-Bus 通信需求。
这些安全增强对于减少攻击面、通过限制权限、保护系统资源和限制潜在利用向量
来提高更新日志复制服务的整体安全态势是必要的。
Log: 增强更新日志复制服务的安全加固
Influence: