Page MenuHomePhabricator

Investigate systemd hardening to replace Firejail for Thumbor
Open, LowPublic

Description

Currently we are running Thumbor under Firejail. Since we will be upgrading Thumbor servers to stretch, we could investigate if we can get the same protection by enabling systemd hardening options.

In addition it makes sense to investigate if we additionally can wrap invocations to external converters like GhostScript in Firejail (with a profile similar to Mediawiki, i.e. restricting network use to a network namespace bound to localhost).

Mentioned in https://gerrit.wikimedia.org/r/#/c/operations/puppet/+/481139/

Update: Looks like it works alright, if we are to use it in prod, we need a condition to use systemd hardening only in stretch

Related Objects

StatusSubtypeAssignedTask
OpenBUG REPORTNone
OpenNone
DuplicateNone
OpenNone
OpenNone
OpenNone
OpenNone
OpenNone
OpenNone
OpenNone
DuplicateNone
OpenNone
OpenNone
OpenBUG REPORTNone
StalledNone
OpenNone
OpenNone
OpenNone
ResolvedNone
OpenNone
OpenNone
ResolvedNone
Resolved Dcoetzee
ResolvedNone
OpenNone
OpenNone
ResolvedGilles
OpenNone
OpenNone
OpenNone
OpenNone
OpenNone
OpenNone

Event Timeline

jijiki triaged this task as Medium priority.Jan 4 2019, 3:06 PM
jijiki created this task.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 4 2019, 3:06 PM

Change 482309 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Switch Thumbor hardening from Firejail to native systemd features (WIP)

https://gerrit.wikimedia.org/r/482309

jijiki moved this task from Backlog to Doing on the serviceops board.Jan 9 2019, 1:40 PM
jijiki moved this task from Backlog/Radar to In Progress on the User-jijiki board.Jan 9 2019, 3:16 PM
jijiki updated the task description. (Show Details)Jan 11 2019, 7:46 PM
jijiki moved this task from Doing to Backlog on the serviceops board.Feb 6 2019, 12:11 PM
jijiki moved this task from In Progress to St on the User-jijiki board.Feb 8 2019, 8:27 AM

Change 482309 had a related patch set uploaded (by Jbond; owner: Muehlenhoff):
[operations/puppet@production] Switch Thumbor hardening from Firejail to native systemd features (WIP)

https://gerrit.wikimedia.org/r/482309

jijiki lowered the priority of this task from Medium to Low.Jun 21 2019, 12:04 PM
jijiki raised the priority of this task from Low to Medium.
jijiki lowered the priority of this task from Medium to Low.Jun 21 2019, 12:07 PM