diff options
| author | nyanmisaka <nst799610810@gmail.com> | 2022-08-13 21:46:35 -0400 |
|---|---|---|
| committer | Joshua Boniface <joshua@boniface.me> | 2022-08-13 21:46:35 -0400 |
| commit | 56805b3368b5c7b133ad71541405ecb66d0621c6 (patch) | |
| tree | eca0a3f030111ff839a5c29e93b6104808232b67 | |
| parent | de9a350bad7d8f9714ad4db88e7b5e3219b1f514 (diff) | |
Backport pull request #8219 from jellyfin/release-10.8.z
Move Fedora service hardening options to override config
Original-merge: 1d4755894eaf5293e1d67dbca5e5c90566963572
Merged-by: Joshua M. Boniface <joshua@boniface.me>
Backported-by: Joshua Boniface <joshua@boniface.me>
| -rw-r--r-- | fedora/jellyfin.override.conf | 46 | ||||
| -rw-r--r-- | fedora/jellyfin.service | 34 |
2 files changed, 46 insertions, 34 deletions
diff --git a/fedora/jellyfin.override.conf b/fedora/jellyfin.override.conf index 8652450bb..48b4de1e9 100644 --- a/fedora/jellyfin.override.conf +++ b/fedora/jellyfin.override.conf @@ -5,3 +5,49 @@ [Service] #User = jellyfin #EnvironmentFile = /etc/sysconfig/jellyfin + +# Service hardening options +# These were added in PR #6953 to solve issue #6952, but some combination of +# them causes "restart.sh" functionality to break with the following error: +# sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the +# 'nosuid' option set or an NFS file system without root privileges? +# See issue #7503 for details on the troubleshooting that went into this. +# Since these were added for NixOS specifically and are above and beyond +# what 99% of systemd units do, they have been moved here as optional +# additional flags to set for maximum system security and can be enabled at +# the administrator's or package maintainer's discretion. +# Uncomment these only if you know what you're doing, and doing so may cause +# bugs with in-server Restart and potentially other functionality as well. +#NoNewPrivileges=true +#SystemCallArchitectures=native +#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +#RestrictNamespaces=false +#RestrictRealtime=true +#RestrictSUIDSGID=true +#ProtectClock=true +#ProtectControlGroups=false +#ProtectHostname=true +#ProtectKernelLogs=false +#ProtectKernelModules=false +#ProtectKernelTunables=false +#LockPersonality=true +#PrivateTmp=false +#PrivateDevices=false +#PrivateUsers=true +#RemoveIPC=true +#SystemCallFilter=~@clock +#SystemCallFilter=~@aio +#SystemCallFilter=~@chown +#SystemCallFilter=~@cpu-emulation +#SystemCallFilter=~@debug +#SystemCallFilter=~@keyring +#SystemCallFilter=~@memlock +#SystemCallFilter=~@module +#SystemCallFilter=~@mount +#SystemCallFilter=~@obsolete +#SystemCallFilter=~@privileged +#SystemCallFilter=~@raw-io +#SystemCallFilter=~@reboot +#SystemCallFilter=~@setuid +#SystemCallFilter=~@swap +#SystemCallErrorNumber=EPERM diff --git a/fedora/jellyfin.service b/fedora/jellyfin.service index 1193ddb5b..eb0d64087 100644 --- a/fedora/jellyfin.service +++ b/fedora/jellyfin.service @@ -13,39 +13,5 @@ Restart = on-failure TimeoutSec = 15 SuccessExitStatus=0 143 -NoNewPrivileges=true -SystemCallArchitectures=native -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK -RestrictNamespaces=false -RestrictRealtime=true -RestrictSUIDSGID=true -ProtectClock=true -ProtectControlGroups=false -ProtectHostname=true -ProtectKernelLogs=false -ProtectKernelModules=false -ProtectKernelTunables=false -LockPersonality=true -PrivateTmp=false -PrivateDevices=false -PrivateUsers=true -RemoveIPC=true -SystemCallFilter=~@clock -SystemCallFilter=~@aio -SystemCallFilter=~@chown -SystemCallFilter=~@cpu-emulation -SystemCallFilter=~@debug -SystemCallFilter=~@keyring -SystemCallFilter=~@memlock -SystemCallFilter=~@module -SystemCallFilter=~@mount -SystemCallFilter=~@obsolete -SystemCallFilter=~@privileged -SystemCallFilter=~@raw-io -SystemCallFilter=~@reboot -SystemCallFilter=~@setuid -SystemCallFilter=~@swap -SystemCallErrorNumber=EPERM - [Install] WantedBy = multi-user.target |