mail-mta/postfix's systemd service, postfix.service, should use systemd's hardening features: * PrivateTmp=true should be used * CapabilityBoundingSet= should be set (I haven't determined exactly to what value yet) * ProtectSystem=full (or at least true) * PrivateDevices=true
https://github.com/gentoo/gentoo/pull/1770
BTW, on another note, I feel like upstream should be distributing the systemd service (with distributions free to customize it, of course!) so I've made a mailing list post requesting they do so: https://groups.google.com/d/msg/list.postfix.users/doN4fj9t41Q/9nrz-zYGAgAJ
Adding systemd to cc to get their input
Obviously the details need to be worked out, but I think it is completely reasonable to have services drop capabilities/etc. These are all fairly low-risk settings to use from a compatibility standpoint. I don't think postfix writes to /etc, but that would need to be confirmed. I'd be happy to do testing of any proposed units. And I agree with the desire to upstream this - I'd think that anything we do with these settings would work on any distro.
(In reply to Richard Freeman from comment #4) > Obviously the details need to be worked out, but I think it is completely > reasonable to have services drop capabilities/etc. These are all fairly > low-risk settings to use from a compatibility standpoint. I don't think > postfix writes to /etc, but that would need to be confirmed. As far as I can tell in my testing, postfix doesn't write to /etc. > > I'd be happy to do testing of any proposed units. The unit I proposed is in the PR I linked to in my previous comment 1. Can you please test and merge if it works well for you? > > And I agree with the desire to upstream this - I'd think that anything we do > with these settings would work on any distro. I haven't received a response from the mailing list post I made. Is there anyone at Gentoo who is a postfix developer/committee who can add this systemd unit for the long term solution?
Ok, I've been testing this for a week on the stable version with no issues. I can't vouch for ~arch, though I see no reason it wouldn't work there. Do you want me to go ahead and revbump both for this?
(In reply to Richard Freeman from comment #6) > Do you want me to go ahead and revbump both for this? Yes, please.
merged into gentoo
