Your message dated Thu, 11 Feb 2016 02:56:47 +0100
with message-id <[email protected]>
and subject line Re: network-manager: Please add ProtectSystem=yes to systemd
service file
has caused the Debian Bug report #771635,
regarding network-manager: Please add ProtectSystem=yes to systemd service file
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
771635: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771635
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: network-manager
Version: 0.9.10.0-3
Severity: wishlist
Dear Maintainer,
*** Reporter, please consider answering these questions, where appropriate ***
* What led up to the situation?
* What exactly did you do (or not do) that was effective (or
ineffective)?
* What was the outcome of this action?
* What outcome did you expect instead?
*** End of the template - remove these template lines ***
Hello,
If you add the option ProtectSystem=yes to the service file, then the
daemon will not have the ability to write to /usr.
There is no reason why it needs to write there, so enabling this
option should not cause any problems.
This option is one of the systemd security features for systemd
service files that was detailed in a talk[0] given by Lennart which
details various security features you can enable in your package's
service files.
micah
[0]
http://ftp.nluug.nl/video/nluug/2014-11-20_nj14/zaal-2/5_Lennart_Poettering_-_Systemd.webm
-- System Information:
Debian Release: jessie/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.16.0-4-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages network-manager depends on:
ii adduser 3.113+nmu3
ii dbus 1.8.12-1
ii init-system-helpers 1.22
ii isc-dhcp-client 4.3.1-5
ii libc6 2.19-13
ii libdbus-1-3 1.8.12-1
ii libdbus-glib-1-2 0.102-1
ii libgcrypt20 1.6.2-4
ii libglib2.0-0 2.42.1-1
ii libgnutls-deb0-28 3.3.8-5
ii libgudev-1.0-0 215-7
ii libmm-glib0 1.4.0-1
ii libndp0 1.4-2
ii libnewt0.52 0.52.17-1+b1
ii libnl-3-200 3.2.24-2
ii libnl-genl-3-200 3.2.24-2
ii libnl-route-3-200 3.2.24-2
ii libnm-glib4 0.9.10.0-3
ii libnm-util2 0.9.10.0-3
ii libpam-systemd 215-7
ii libpolkit-gobject-1-0 0.105-8
ii libreadline6 6.3-8+b1
ii libsoup2.4-1 2.48.0-1
ii libsystemd0 215-7
ii libteamdctl0 1.12-1
ii libuuid1 2.25.2-3
ii lsb-base 4.1+Debian13+nmu1
ii policykit-1 0.105-8
ii udev 215-7
ii wpasupplicant 2.3-1
Versions of packages network-manager recommends:
ii crda 3.13-1
ii dnsmasq-base 2.72-2
ii iptables 1.4.21-2+b1
ii modemmanager 1.4.0-1
ii ppp 2.4.6-3
Versions of packages network-manager suggests:
pn avahi-autoipd <none>
pn libteam-utils <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 1.1.90-1
On Sun, 30 Nov 2014 22:53:56 -0500 Micah Anderson <[email protected]> wrote:
> If you add the option ProtectSystem=yes to the service file, then the
> daemon will not have the ability to write to /usr.
>
> There is no reason why it needs to write there, so enabling this
> option should not cause any problems.
>
> This option is one of the systemd security features for systemd
> service files that was detailed in a talk[0] given by Lennart which
> details various security features you can enable in your package's
> service files.
The current version in unstable contains:
CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW
CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE
CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT
ProtectSystem=true
ProtectHome=read-only
So it's locked down even more then what was requested in this bug
report. I therefor consider this issue resolved.
Michael
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
signature.asc
Description: OpenPGP digital signature
--- End Message ---
_______________________________________________
Pkg-utopia-maintainers mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-utopia-maintainers
