Page MenuHomePhabricator

Investigate systemd hardening to replace Firejail for Thumbor
Open, LowPublic

Description

Currently we are running Thumbor under Firejail. Since we will be upgrading Thumbor servers to buster, we could investigate if we can get the same protection by enabling systemd hardening options.

In addition it makes sense to investigate if we additionally can wrap invocations to external converters like GhostScript in Firejail (with a profile similar to Mediawiki, i.e. restricting network use to a network namespace bound to localhost).

Mentioned in https://gerrit.wikimedia.org/r/#/c/operations/puppet/+/481139/

Update: Looks like it works alright, if we are to use it in prod, we need a condition to use systemd hardening only in stretch

Related Objects

View Standalone Graph
This task is connected to more than 200 other tasks. Only direct parents and subtasks are shown here. Use View Standalone Graph to show more of the graph.
StatusSubtypeAssignedTask
OpenNone
OpenNone

Event Timeline

jijiki triaged this task as Medium priority.Jan 4 2019, 3:06 PM
jijiki created this task.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 4 2019, 3:06 PM

Change 482309 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Switch Thumbor hardening from Firejail to native systemd features (WIP)

https://gerrit.wikimedia.org/r/482309

jijiki moved this task from Incoming 🐫 to Doing 😎 on the serviceops board.Jan 9 2019, 1:40 PM
jijiki updated the task description. (Show Details)Jan 11 2019, 7:46 PM
jijiki moved this task from Doing 😎 to Incoming 🐫 on the serviceops board.Feb 6 2019, 12:11 PM

Change 482309 had a related patch set uploaded (by Jbond; owner: Muehlenhoff):
[operations/puppet@production] Switch Thumbor hardening from Firejail to native systemd features (WIP)

https://gerrit.wikimedia.org/r/482309

jijiki lowered the priority of this task from Medium to Low.Jun 21 2019, 12:04 PM
jijiki raised the priority of this task from Low to Medium.
jijiki lowered the priority of this task from Medium to Low.Jun 21 2019, 12:07 PM
jijiki moved this task from Incoming 🐫 to Unsorted on the serviceops board.Aug 17 2020, 11:48 PM
jijiki moved this task from St to Thumbor on the User-jijiki board.Sep 8 2020, 10:22 AM
Ladsgroup updated the task description. (Show Details)Oct 8 2020, 7:23 PM

Change 482309 abandoned by Muehlenhoff:
[operations/puppet@production] Switch Thumbor hardening from Firejail to native systemd features (WIP)

Reason:
old PoC

https://gerrit.wikimedia.org/r/482309