Page MenuHomePhorge
Files F85832201

No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/changelog.d/no_new_privs.add b/changelog.d/no_new_privs.add
new file mode 100644
index 000000000..b67396a4b
--- /dev/null
+++ b/changelog.d/no_new_privs.add
@@ -0,0 +1 @@
+(hardening) Add no_new_privs=yes to OpenRC service files
diff --git a/installation/init.d/pleroma b/installation/init.d/pleroma
index 384536f7e..cb6635a0b 100755
--- a/installation/init.d/pleroma
+++ b/installation/init.d/pleroma
@@ -1,45 +1,46 @@
#!/sbin/openrc-run
supervisor=supervise-daemon
command_user=pleroma:pleroma
command_background=1
# Ask process to terminate within 30 seconds, otherwise kill it
retry="SIGTERM/30/SIGKILL/5"
pidfile="/var/run/pleroma.pid"
directory=/opt/pleroma
healthcheck_delay=60
healthcheck_timer=30
+no_new_privs="yes"
: ${pleroma_port:-4000}
# Needs OpenRC >= 0.42
#respawn_max=0
#respawn_delay=5
# put pleroma_console=YES in /etc/conf.d/pleroma if you want to be able to
# connect to pleroma via an elixir console
if yesno "${pleroma_console}"; then
command=elixir
command_args="--name pleroma@127.0.0.1 --erl '-kernel inet_dist_listen_min 9001 inet_dist_listen_max 9001 inet_dist_use_interface {127,0,0,1}' -S mix phx.server"
start_post() {
einfo "You can get a console by using this command as pleroma's user:"
einfo "iex --name console@127.0.0.1 --remsh pleroma@127.0.0.1"
}
else
command=/usr/bin/mix
command_args="phx.server"
fi
export MIX_ENV=prod
depend() {
need nginx postgresql
}
healthcheck() {
# put pleroma_health=YES in /etc/conf.d/pleroma if you want healthchecking
# and make sure you have curl installed
yesno "$pleroma_health" || return 0
curl -q "localhost:${pleroma_port}/api/pleroma/healthcheck"
}
diff --git a/rel/files/installation/init.d/pleroma b/rel/files/installation/init.d/pleroma
index dea1db26c..ca5b842e1 100755
--- a/rel/files/installation/init.d/pleroma
+++ b/rel/files/installation/init.d/pleroma
@@ -1,21 +1,22 @@
#!/sbin/openrc-run
supervisor=supervise-daemon
# Requires OpenRC >= 0.35
directory=/opt/pleroma
command=/opt/pleroma/bin/pleroma
command_args="start"
command_user=pleroma
command_background=1
+no_new_privs="yes"
# Ask process to terminate within 30 seconds, otherwise kill it
retry="SIGTERM/30/SIGKILL/5"
pidfile="/var/run/pleroma.pid"
depend() {
want nginx
need postgresql
}

File Metadata

Mime Type
text/x-diff
Expires
Mon, Nov 2, 6:07 AM (16 h, 58 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1803627
Default Alt Text
(2 KB)

Event Timeline