Bug 587586 – net-dns/dnsmasq: improve systemd unit (including security hardening)

• Status: UNCONFIRMED
• Product: Gentoo Linux

[Description Craig Andrews 2016-06-30 14:17:20 UTC]

The dnsmasq.service systemd unit can be improved by having dnsmasq never run as root, restricting capabilities as much as possible, and limiting file system access.

This has been discussed on the forums at https://forums.gentoo.org/viewtopic-p-7907924.html?sid=03b7d4158d14b19351a6c772b87a2fbd

[Comment 1 Craig Andrews 2016-06-30 14:18:00 UTC]

https://github.com/gentoo/gentoo/pull/1798

[Comment 2 Ben Kohler 2016-06-30 14:40:10 UTC]

Created attachment 439234 [details, diff]
diff based on c1 PR link

[Comment 3 Craig Andrews 2016-06-30 15:01:03 UTC]

I've posted to the upstream mailing list requesting that upstream distribute a systemd unit and that it have these features: http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010656.html

[Comment 4 Matthias Maier 2016-08-08 21:12:12 UTC]

The configuration option

  AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN

is only with systemd-229, or newer.

While I agree that some system hardening is a nice feature to introduce I would suggest that we let dnsmasq still handle the suid and sguid bits on its own. This has the advantage that the daemon can actually drop privileges/capabilities once it is done with setup.

See #587588