Bug 586984 – www-servers/apache: systemd hardening

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Craig Andrews 2016-06-24 21:23:40 UTC]

www-servers/apache2's systemd service, apache2.service, should use systemd's hardening features:
* PrivateTmp=true should be used. This would align Gentoo with the Red Hat / Fedora /CentOS family, which made this change in 2012: http://danwalsh.livejournal.com/51459.html
* CapabilityBoundingSet= should be set
* ProtectSystem=full (or at least true)
* NoNewPrivileges=true
* PrivateDevices=true

I tested these settings and didn't experience any problems in my (admitted limited) setup. I think they should be fine for anyone except for exceptional and odd situations (ex, apache is setup to read files from /tmp that another services writes to /tmp). For the (very rare) impacted user, they can always override the systemd service - but a secure configuration should be the default.

[Comment 1 Craig Andrews 2016-06-24 21:28:11 UTC]

https://github.com/gentoo/gentoo/pull/1739

[Comment 2 Craig Andrews 2016-06-27 14:47:32 UTC]

BTW, on another note, I feel like upstream should be distributing the systemd service (with distributions free to customize it, of course!) so I've reported a bug in httpd requesting them to do so: https://bz.apache.org/bugzilla/show_bug.cgi?id=59760

[Comment 3 Lars Wendler (Polynomial-C) (RETIRED) 2016-06-30 20:45:34 UTC]

Since I do not use systemd anywhere nor do I have the tiniest interest in learning any systemd internals, I have CCed our systemd team so they can do whatever is necessary here.

[Comment 4 Richard Freeman 2016-07-01 20:33:19 UTC]

Sure, I'll test, and assuming there are no objections commit the change.

[Comment 5 Lars Wendler (Polynomial-C) (RETIRED) 2016-07-06 10:42:06 UTC]

(In reply to Richard Freeman from comment #4)
> Sure, I'll test, and assuming there are no objections commit the change.

No objections from my side.

[Comment 6 Richard Freeman 2016-07-09 12:53:19 UTC]

Ok, I've been testing this for a week on the stable version with no issues.  I can't vouch for ~arch, though I see no reason it wouldn't work there.  Do you want me to go ahead and revbump both for this?

[Comment 7 Lars Wendler (Polynomial-C) (RETIRED) 2016-07-12 12:14:02 UTC]

(In reply to Richard Freeman from comment #6)
> Ok, I've been testing this for a week on the stable version with no issues. 
> I can't vouch for ~arch, though I see no reason it wouldn't work there.  Do
> you want me to go ahead and revbump both for this?

I already gave you my okay and didn't change my mind since ;)

[Comment 8 Richard Freeman 2016-07-12 12:41:52 UTC]

(In reply to Lars Wendler (Polynomial-C) from comment #7)
> (In reply to Richard Freeman from comment #6)
> > Ok, I've been testing this for a week on the stable version with no issues. 
> > I can't vouch for ~arch, though I see no reason it wouldn't work there.  Do
> > you want me to go ahead and revbump both for this?
> 
> I already gave you my okay and didn't change my mind since ;)

Yup, my question was more about being OK with going straight to stable and bumping ~arch without specifically testing it.  I'll do so shortly.

[Comment 9 Craig Andrews 2016-08-08 19:31:00 UTC]

Any updates? I just rebased the PR and believe it's all set to merge: https://github.com/gentoo/gentoo/pull/1739

[Comment 10 Richard Freeman 2016-08-13 20:52:53 UTC]

Ok, committed to gentoo...

[Comment 11 Russell Yanofsky 2016-11-20 14:32:52 UTC]

Problem with suexec caused by this change reported in: https://bugs.gentoo.org/show_bug.cgi?id=600292