From db1be9ddcd5cb9c5f12583ca5b6f79c4a19fd061 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Thu, 3 Nov 2022 21:52:52 +0000 Subject: [PATCH] Improve filesystem sandboxing for tile services --- cookbooks/tile/recipes/default.rb | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/cookbooks/tile/recipes/default.rb b/cookbooks/tile/recipes/default.rb index d726a2220..576c0f6ad 100644 --- a/cookbooks/tile/recipes/default.rb +++ b/cookbooks/tile/recipes/default.rb @@ -284,8 +284,12 @@ systemd_service "update-lowzoom@" do private_tmp true private_devices true private_network true - protect_system "full" + protect_system "strict" protect_home true + read_write_paths [ + "/srv/tile.openstreetmap.org/tiles/%i", + "/var/log/tile" + ] no_new_privileges true restart "on-failure" end @@ -546,7 +550,7 @@ systemd_service "tile-ratelimit" do private_tmp true private_devices true private_network true - protect_system "full" + protect_system "strict" protect_home true read_write_paths "/srv/tile.openstreetmap.org/conf" no_new_privileges true @@ -595,8 +599,13 @@ systemd_service "expire-tiles" do standard_output "null" private_tmp true private_devices true - protect_system "full" + protect_system "strict" protect_home true + read_write_paths [ + "/srv/tile.openstreetmap.org/tiles/%i", + "/var/lib/replicate/expire-queue", + "/var/log/tile" + ] no_new_privileges true end @@ -618,8 +627,13 @@ systemd_service "replicate" do exec_start "/usr/local/bin/replicate" private_tmp true private_devices true - protect_system "full" + protect_system "strict" protect_home true + read_write_paths [ + "/store/database/nodes", + "/var/lib/replicate", + "/var/log/tile" + ] no_new_privileges true restart "on-failure" end @@ -652,8 +666,9 @@ systemd_service "render-lowzoom" do private_tmp true private_devices true private_network true - protect_system "full" + protect_system "strict" protect_home true + read_write_paths "/var/log/tile" no_new_privileges true end -- 2.39.5