Changes/SystemdSecurityHardening

Enable systemd service hardening for default and high profile services

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Summary

Improve security of default services by enabling some of the high impact systemd service hardening knobs for all default and high profile services.

Owner

-->

• Name: Rahul Sundaram
• Email: metherid@gmail.com

Current status

• Targeted release: Fedora 40
• Last updated: 2023-11-15
• [<will be assigned by the Wrangler> devel thread]
• FESCo issue: <will be assigned by the Wrangler>
• Tracker bug: <will be assigned by the Wrangler>
• Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

The specific toggles under consideration include the following

• PrivateTmp=yes
• ProtectSystem=yes/full/strict
• ProtectHome=yes
• PrivateDevices=yes
• ProtectKernelTunables=yes
• ProtectKernelModules=yes
• ProtectControlGroups=yes
• NoNewPrivileges=yes

We will enable as many of these as feasible for the services but not every toggle is going to be applicable to every service. For example, ProtectHome=yes wouldn't work for any of the systemd user services but ProtectHome=read-only might and PrivateNetwork can only be used for services that work locally.

Benefit to Fedora

Fedora services will get a significant security boost by default by avoiding or mitigatating security vulnerabilities in these services.

Scope

• Proposal owners:

• Other developers:

• Release engineering: #Releng issue number

• Policies and guidelines: N/A (not needed for this Change)

• Trademark approval: N/A (not needed for this Change)

• Alignment with Community Initiatives:

User Experience

This should be a fully transparent change for users.

Dependencies

None. We are merely enabling some long supported systemd features by default for default and high profile services.

Contingency Plan

• Contingency mechanism: These settings can be enabled/disabled at a per service level. No wholesale reverts is necessary. If we don't finish the work for all the services, we can follow through in future releases.
• Contingency deadline: N/A
• Blocks release? No

Documentation

• https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html
• https://www.redhat.com/sysadmin/systemd-secure-services
• https://www.redhat.com/sysadmin/mastering-systemd

N/A (not a System Wide Change)

Release Notes

systemd security hardening features are enabled for default services and following high profile services.

• Postgres
• Apache Httpd
• Nginx
• MariaDB

....