Go to:
Gentoo Home
Documentation
Forums
Lists
Bugs
Planet
Store
Wiki
Get Gentoo!
Gentoo's Bugzilla – Attachment 439234 Details for
Bug 587586
net-dns/dnsmasq: improve systemd unit (including security hardening)
Home
|
New
–
[Ex]
|
Browse
|
Search
|
Privacy Policy
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
diff based on c1 PR link
1798.patch (text/plain), 1.33 KB, created by
Ben Kohler
on 2016-06-30 14:40:10 UTC
(
hide
)
Description:
diff based on c1 PR link
Filename:
MIME Type:
Creator:
Ben Kohler
Created:
2016-06-30 14:40:10 UTC
Size:
1.33 KB
patch
obsolete
>From f12bb76fc468661d5624d838b48937736fd624ec Mon Sep 17 00:00:00 2001 >From: Craig Andrews <candrews@integralblue.com> >Date: Thu, 30 Jun 2016 10:17:30 -0400 >Subject: [PATCH] net-dns/dnsmasq: systemd hardening > >Improve the systemd unit by having dnsmasq never run as root, restricting capabilities as much as possible, and limiting file system access. > >Gentoo-bug: 587586 >--- > net-dns/dnsmasq/files/dnsmasq.service-r1 | 13 ++++++++++++- > 1 file changed, 12 insertions(+), 1 deletion(-) > >diff --git a/net-dns/dnsmasq/files/dnsmasq.service-r1 b/net-dns/dnsmasq/files/dnsmasq.service-r1 >index 8e313bc..b288afd 100644 >--- a/net-dns/dnsmasq/files/dnsmasq.service-r1 >+++ b/net-dns/dnsmasq/files/dnsmasq.service-r1 >@@ -3,10 +3,21 @@ Description=A lightweight DHCP and caching DNS server > After=network.target > > [Service] >+User=dnsmasq >+Group=dnsmasq > Type=simple >+PIDFile=/run/dnsmasq/dnsmasq.pid > ExecStartPre=/usr/sbin/dnsmasq --test >-ExecStart=/usr/sbin/dnsmasq -k --user=dnsmasq --group=dnsmasq >+ExecStart=/usr/sbin/dnsmasq -k -x /run/dnsmasq/dnsmasq.pid > ExecReload=/bin/kill -HUP $MAINPID >+RuntimeDirectory=dnsmasq >+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN >+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN >+PrivateTmp=yes >+PrivateDevices=yes >+ProtectSystem=full >+ProtectHome=yes >+NoNewPrivileges=yes > > [Install] > WantedBy=multi-user.target
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 587586
: 439234