From T90115
I don't have any concerns/objections about setting this up, I mostly wanted to know the status of the various countermeasures mentioned in this task.
What kind of measures do you propose?
systemd supports various features to restrict running processes, e.g. for restricting filesystem access or through disallowing potentially harmful syscalls using seccomp-bpf. This doesn't need to be present in the initial deployment, but it would be good to add in a followup step.
This seems to be dormant for a long time. @csteipp, do you have any specific advice as to what should be done here? Or given the fact it's running on their own servers it may be unnecessary? Would like to hear some advice on this.
We have this config in systemd right now:
PrivateDevices=yes ProtectSystem=full ProtectHome=yes NoNewPrivileges=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 ReadOnlyDirectories=/ # data storage ReadWriteDirectories=/srv/wdqs # logs ReadWriteDirectories=/var/log/wdqs # already protected by PrivateTmp ReadWriteDirectories=/tmp /var/tmp
I think this can be closed. If there's more needed, please reopen and describe what is missing.