Detect the systemd version and enable sandboxing features accordingly

diff --git a/configure.ac b/configure.ac
index 259604bbd1181c61df986a7c8ef519de4dc12aa5..6f00864e54ad13fbd180e72c78971de490d39917 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -270,6 +270,7 @@ for a in $dynmodules; do
 done
 
 AX_AVAILABLE_SYSTEMD
+AX_CHECK_SYSTEMD_FEATURES
 AM_CONDITIONAL([HAVE_SYSTEMD], [ test x"$systemd" = "xy" ])
 
 LDFLAGS="$RELRO_LDFLAGS $LDFLAGS"

diff --git a/m4/systemd.m4 b/m4/systemd.m4
index ec2a1953888ad3db00d560af6667c6f93e90dbda..0e39e9f6a3a5923515357a5bee98814b3a0cd002 100644 (file)
--- a/m4/systemd.m4
+++ b/m4/systemd.m4
@@ -128,3 +128,66 @@ AC_DEFUN([AX_AVAILABLE_SYSTEMD], [
        AX_CHECK_SYSTEMD_DETECT_AND_ENABLE()
        AX_CHECK_SYSTEMD()
 ])
+
+AC_DEFUN([AX_CHECK_SYSTEMD_FEATURES], [
+        if test x"$systemd" = "xy"; then
+            _systemd_version=`systemctl --version|head -1 |cut -d" " -f 2`
+            if test $_systemd_version -ge 183; then
+               systemd_private_tmp=y
+            fi
+            if test $_systemd_version -ge 209; then
+               systemd_system_call_architectures=y
+               systemd_private_devices=y
+            fi
+            if test $_systemd_version -ge 211; then
+               systemd_restrict_address_families=y
+            fi
+            if test $_systemd_version -ge 214; then
+               systemd_protect_system=y
+               systemd_protect_home=y
+            fi
+            if test $_systemd_version -ge 231; then
+               systemd_restrict_realtime=y
+               systemd_memory_deny_write_execute=y
+            fi
+            if test $_systemd_version -ge 232; then
+               systemd_protect_control_groups=y
+               systemd_protect_kernel_modules=y
+               systemd_protect_kernel_tunables=y
+               systemd_remove_ipc=y
+               systemd_dynamic_user=y
+               systemd_private_users=y
+               systemd_protect_system_strict=y
+            fi
+            if test $_systemd_version -ge 233; then
+               systemd_restrict_namespaces=y
+            fi
+            if test $_systemd_version -ge 235; then
+               systemd_lock_personality=y
+               # while SystemCallFilter is technically available starting with 187,
+               # we use the pre-defined call filter sets that have been introduced later.
+               # Initial support for these landed in 231
+               # @filesystem @reboot @swap in 233
+               # @aio, @sync, @chown, @setuid, @memlock, @signal and @timer in 235
+               systemd_system_call_filter=y
+            fi
+        fi
+        AM_CONDITIONAL([HAVE_SYSTEMD_DYNAMIC_USER], [ test x"$systemd_dynamic_user" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_LOCK_PERSONALITY], [ test x"$systemd_lock_personality" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_MEMORY_DENY_WRITE_EXECUTE], [ test x"$systemd_memory_deny_write_execute" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_PRIVATE_DEVICES], [ test x"$systemd_private_devices" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_PRIVATE_TMP], [ test x"$systemd_private_tmp" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_PRIVATE_USERS], [ test x"$systemd_private_users" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_PROTECT_CONTROL_GROUPS], [ test x"$systemd_protect_control_groups" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_PROTECT_HOME], [ test x"$systemd_protect_home" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_PROTECT_KERNEL_MODULES], [ test x"$systemd_protect_kernel_modules" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_PROTECT_KERNEL_TUNABLES], [ test x"$systemd_protect_kernel_tunables" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_PROTECT_SYSTEM], [ test x"$systemd_protect_system" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_PROTECT_SYSTEM_STRICT], [ test x"$systemd_protect_system_strict" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_REMOVE_IPC], [ test x"$systemd_remove_ipc" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_RESTRICT_ADDRESS_FAMILIES], [ test x"$systemd_restrict_address_families" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_RESTRICT_NAMESPACES], [ test x"$systemd_restrict_namespaces" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_RESTRICT_REALTIME], [ test x"$systemd_restrict_realtime" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_SYSTEM_CALL_ARCHITECTURES], [ test x"$systemd_system_call_architectures" = "xy" ])
+        AM_CONDITIONAL([HAVE_SYSTEMD_SYSTEM_CALL_FILTER], [ test x"$systemd_system_call_filter" = "xy" ])
+])

diff --git a/pdns/Makefile.am b/pdns/Makefile.am
index 73f73791dceb7e5906b37a85423128d32beeb405..9f6d7351d1f48f53cad574171122d72b4652f174 100644 (file)
--- a/pdns/Makefile.am
+++ b/pdns/Makefile.am
@@ -1513,6 +1513,45 @@ dnsdist:
 if HAVE_SYSTEMD
 pdns.service: pdns.service.in
        $(AM_V_GEN)sed -e 's![@]sbindir[@]!$(sbindir)!' < $< > $@
+if !HAVE_SYSTEMD_LOCK_PERSONALITY
+       $(AM_V_GEN)sed -i '' -e '/^LockPersonality/d' $@
+endif
+if !HAVE_SYSTEMD_PRIVATE_DEVICES
+       $(AM_V_GEN)sed -i '' -e '/^PrivateDevices/d' $@
+endif
+if !HAVE_SYSTEMD_PRIVATE_TMP
+       $(AM_V_GEN)sed -i '' -e '/^PrivateTmp/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_CONTROL_GROUPS
+       $(AM_V_GEN)sed -i '' -e '/^ProtectControlGroups/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_HOME
+       $(AM_V_GEN)sed -i '' -e '/^ProtectHome/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_KERNEL_MODULES
+       $(AM_V_GEN)sed -i '' -e '/^ProtectKernelModules/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_KERNEL_TUNABLES
+       $(AM_V_GEN)sed -i '' -e '/^ProtectKernelTunables/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_SYSTEM
+       $(AM_V_GEN)sed -i '' -e '/^ProtectSystem/d' $@
+endif
+if !HAVE_SYSTEMD_RESTRICT_ADDRESS_FAMILIES
+       $(AM_V_GEN)sed -i '' -e '/^RestrictAddressFamilies/d' $@
+endif
+if !HAVE_SYSTEMD_RESTRICT_NAMESPACES
+       $(AM_V_GEN)sed -i '' -e '/^RestrictNamespaces/d' $@
+endif
+if !HAVE_SYSTEMD_RESTRICT_REALTIME
+       $(AM_V_GEN)sed -i '' -e '/^RestrictRealtime/d' $@
+endif
+if !HAVE_SYSTEMD_SYSTEM_CALL_ARCHITECTURES
+       $(AM_V_GEN)sed -i '' -e '/^SystemCallArchitectures/d' $@
+endif
+if !HAVE_SYSTEMD_SYSTEM_CALL_FILTER
+       $(AM_V_GEN)sed -i '' -e '/^SystemCallFilter/d' $@
+endif
 
 pdns@.service: pdns.service
        $(AM_V_GEN)sed -e 's!/pdns_server!& --config-name=%i!' \

diff --git a/pdns/dnsdistdist/Makefile.am b/pdns/dnsdistdist/Makefile.am
index 9f422a86cdac138ee7dcf8018533a99c021bb05f..1f49403481a8d3f790cc139a0b3abe69bb4fe3db 100644 (file)
--- a/pdns/dnsdistdist/Makefile.am
+++ b/pdns/dnsdistdist/Makefile.am
@@ -322,6 +322,45 @@ endif
 if HAVE_SYSTEMD
 dnsdist.service: dnsdist.service.in
        $(AM_V_GEN)sed -e 's![@]bindir[@]!$(bindir)!' < $< > $@
+if !HAVE_SYSTEMD_LOCK_PERSONALITY
+       $(AM_V_GEN)sed -i '' -e '/^LockPersonality/d' $@
+endif
+if !HAVE_SYSTEMD_PRIVATE_DEVICES
+       $(AM_V_GEN)sed -i '' -e '/^PrivateDevices/d' $@
+endif
+if !HAVE_SYSTEMD_PRIVATE_TMP
+       $(AM_V_GEN)sed -i '' -e '/^PrivateTmp/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_CONTROL_GROUPS
+       $(AM_V_GEN)sed -i '' -e '/^ProtectControlGroups/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_HOME
+       $(AM_V_GEN)sed -i '' -e '/^ProtectHome/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_KERNEL_MODULES
+       $(AM_V_GEN)sed -i '' -e '/^ProtectKernelModules/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_KERNEL_TUNABLES
+       $(AM_V_GEN)sed -i '' -e '/^ProtectKernelTunables/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_SYSTEM
+       $(AM_V_GEN)sed -i '' -e '/^ProtectSystem/d' $@
+endif
+if !HAVE_SYSTEMD_RESTRICT_ADDRESS_FAMILIES
+       $(AM_V_GEN)sed -i '' -e '/^RestrictAddressFamilies/d' $@
+endif
+if !HAVE_SYSTEMD_RESTRICT_NAMESPACES
+       $(AM_V_GEN)sed -i '' -e '/^RestrictNamespaces/d' $@
+endif
+if !HAVE_SYSTEMD_RESTRICT_REALTIME
+       $(AM_V_GEN)sed -i '' -e '/^RestrictRealtime/d' $@
+endif
+if !HAVE_SYSTEMD_SYSTEM_CALL_ARCHITECTURES
+       $(AM_V_GEN)sed -i '' -e '/^SystemCallArchitectures/d' $@
+endif
+if !HAVE_SYSTEMD_SYSTEM_CALL_FILTER
+       $(AM_V_GEN)sed -i '' -e '/^SystemCallFilter/d' $@
+endif
 
 dnsdist@.service: dnsdist.service
        $(AM_V_GEN)sed -e 's!/dnsdist !&--config $(sysconfdir)/dnsdist-%i.conf !' < $< >$@

diff --git a/pdns/dnsdistdist/configure.ac b/pdns/dnsdistdist/configure.ac
index 6ee328f24ddc3043cd55c7402fb4690c9a94d94b..1ed08b9999dc3a057fe319a386e087de3fe010a4 100644 (file)
--- a/pdns/dnsdistdist/configure.ac
+++ b/pdns/dnsdistdist/configure.ac
@@ -43,6 +43,7 @@ PDNS_WITH_NET_SNMP
 PDNS_WITH_LIBCAP
 
 AX_AVAILABLE_SYSTEMD
+AX_CHECK_SYSTEMD_FEATURES
 AM_CONDITIONAL([HAVE_SYSTEMD], [ test x"$systemd" = "xy" ])
 
 AC_SUBST([YAHTTP_CFLAGS], ['-I$(top_srcdir)/ext/yahttp'])

diff --git a/pdns/dnsdistdist/dnsdist.service.in b/pdns/dnsdistdist/dnsdist.service.in
index f64f1a9f04bc03b015be13b2b4d57adc07ac6b7c..094ffe3ed4e1e8666bef270e298f2a09113d2730 100644 (file)
--- a/pdns/dnsdistdist/dnsdist.service.in
+++ b/pdns/dnsdistdist/dnsdist.service.in
@@ -33,6 +33,8 @@ ProtectSystem=full
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictNamespaces=true
 RestrictRealtime=true
+SystemCallArchitectures=native
+SystemCallFilter=~ @clock @debug @module @mount @raw-io @reboot @swap @cpu-emulation @obsolete
 
 [Install]
 WantedBy=multi-user.target

diff --git a/pdns/pdns.service.in b/pdns/pdns.service.in
index 928ec466435e2c0d358a9b80f343c40febbecc5e..60a6e075ab7086f420a10c0ff855916e23770620 100644 (file)
--- a/pdns/pdns.service.in
+++ b/pdns/pdns.service.in
@@ -25,6 +25,8 @@ ProtectSystem=full
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictNamespaces=true
 RestrictRealtime=true
+SystemCallArchitectures=native
+SystemCallFilter=~ @clock @debug @module @mount @raw-io @reboot @swap @cpu-emulation @obsolete
 
 [Install]
 WantedBy=multi-user.target

diff --git a/pdns/recursordist/Makefile.am b/pdns/recursordist/Makefile.am
index 022cc6cb3fb2c782e99b40a0cf66589e0d2e7e67..51ad4489ba1ed0684cc0a5e04566363b25889f88 100644 (file)
--- a/pdns/recursordist/Makefile.am
+++ b/pdns/recursordist/Makefile.am
@@ -446,6 +446,45 @@ endif
 if HAVE_SYSTEMD
 pdns-recursor.service: pdns-recursor.service.in
        $(AM_V_GEN)sed -e 's![@]sbindir[@]!$(sbindir)!' < $< > $@
+if !HAVE_SYSTEMD_LOCK_PERSONALITY
+       $(AM_V_GEN)sed -i '' -e '/^LockPersonality/d' $@
+endif
+if !HAVE_SYSTEMD_PRIVATE_DEVICES
+       $(AM_V_GEN)sed -i '' -e '/^PrivateDevices/d' $@
+endif
+if !HAVE_SYSTEMD_PRIVATE_TMP
+       $(AM_V_GEN)sed -i '' -e '/^PrivateTmp/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_CONTROL_GROUPS
+       $(AM_V_GEN)sed -i '' -e '/^ProtectControlGroups/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_HOME
+       $(AM_V_GEN)sed -i '' -e '/^ProtectHome/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_KERNEL_MODULES
+       $(AM_V_GEN)sed -i '' -e '/^ProtectKernelModules/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_KERNEL_TUNABLES
+       $(AM_V_GEN)sed -i '' -e '/^ProtectKernelTunables/d' $@
+endif
+if !HAVE_SYSTEMD_PROTECT_SYSTEM
+       $(AM_V_GEN)sed -i '' -e '/^ProtectSystem/d' $@
+endif
+if !HAVE_SYSTEMD_RESTRICT_ADDRESS_FAMILIES
+       $(AM_V_GEN)sed -i '' -e '/^RestrictAddressFamilies/d' $@
+endif
+if !HAVE_SYSTEMD_RESTRICT_NAMESPACES
+       $(AM_V_GEN)sed -i '' -e '/^RestrictNamespaces/d' $@
+endif
+if !HAVE_SYSTEMD_RESTRICT_REALTIME
+       $(AM_V_GEN)sed -i '' -e '/^RestrictRealtime/d' $@
+endif
+if !HAVE_SYSTEMD_SYSTEM_CALL_ARCHITECTURES
+       $(AM_V_GEN)sed -i '' -e '/^SystemCallArchitectures/d' $@
+endif
+if !HAVE_SYSTEMD_SYSTEM_CALL_FILTER
+       $(AM_V_GEN)sed -i '' -e '/^SystemCallFilter/d' $@
+endif
 
 pdns-recursor@.service: pdns-recursor.service
        $(AM_V_GEN)sed -e 's!/pdns_recursor!& --config-name=%i!' \

diff --git a/pdns/recursordist/configure.ac b/pdns/recursordist/configure.ac
index d3ceb2b2e72d22db7a639b66af3b30e813a0462c..155e8373947613c2129c25042e78e0e9c6b5fed6 100644 (file)
--- a/pdns/recursordist/configure.ac
+++ b/pdns/recursordist/configure.ac
@@ -175,6 +175,7 @@ PDNS_ENABLE_SANITIZERS
 PDNS_ENABLE_MALLOC_TRACE
 PDNS_ENABLE_VALGRIND
 AX_AVAILABLE_SYSTEMD
+AX_CHECK_SYSTEMD_FEATURES
 AM_CONDITIONAL([HAVE_SYSTEMD], [ test x"$systemd" = "xy" ])
 PDNS_CHECK_VIRTUALENV
 

diff --git a/pdns/recursordist/pdns-recursor.service.in b/pdns/recursordist/pdns-recursor.service.in
index 8855acaee817e460368c563bcc9941b98bb9164c..357af43290bec09768ab7cf121831d04e4084a14 100644 (file)
--- a/pdns/recursordist/pdns-recursor.service.in
+++ b/pdns/recursordist/pdns-recursor.service.in
@@ -29,6 +29,8 @@ ProtectSystem=full
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictNamespaces=true
 RestrictRealtime=true
+SystemCallArchitectures=native
+SystemCallFilter=~ @clock @debug @module @mount @raw-io @reboot @swap @cpu-emulation @obsolete
 
 [Install]
 WantedBy=multi-user.target