Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

systemd: Lock down cockpit-ws and -tls #21305

Merged
merged 3 commits into from
Nov 25, 2024
Merged

systemd: Lock down cockpit-ws and -tls #21305

merged 3 commits into from
Nov 25, 2024

Commits on Nov 25, 2024

  1. systemd: Lock down cockpit-ws 

    Now that cockpit-ws does not directly fork cockpit-session, and sessions
run in their own service/cgroup, we can heavily lock down our webserver
(which is the weakest component in Cockpit). It only needs to talk to
cockpit-tls over stdin/out and cockpit-session over the Unix socket,
and call SSH for remote host support (so we can't lock down networking
completely).

`DynamicUser=` already implies the biggest restrictions, such as
`ProtectSystem=full`, `ProtectHome`, `PrivateTmp`, and more. We can even
work with `ProtectSystem=strict` (i.e. everything being read-only except
the service's /run directory and tmp dir).

Fixes cockpit-project#21299
https://issues.redhat.com/browse/COCKPIT-1206
    @martinpitt
    martinpitt committed Nov 25, 2024
    Configuration menu
    Copy the full SHA
    ba58841 View commit details
    Browse the repository at this point in the history

  2. systemd: Clean up cockpit.service.in 

    Consistently use "yes" for boolean options.

`DynamicUser` already implies `PrivateTmp` and `ProtectHome`.
    @martinpitt
    martinpitt committed Nov 25, 2024
    Configuration menu
    Copy the full SHA
    ac83f28 View commit details
    Browse the repository at this point in the history

  3. systemd: Lock down cockpit-tls networking 

    cockpit-tls speaks to the outside world via socket activation, and to
cockpit-ws via Unix socket. So it doesn't require much networking on its
own.
    @martinpitt
    martinpitt committed Nov 25, 2024
    Configuration menu
    Copy the full SHA
    fe6813f View commit details
    Browse the repository at this point in the history