Commit 36d3d9d7 authored by Bastien Nocera's avatar Bastien Nocera

data: Lockdown the fprintd service

Give read-write access to USB devices in /dev, and the location of the
fingerprints, access to Unix sockets for D-Bus and
close everything else down.

See systemd.exec(5) for details about the options.
parent b3c1ed0d
......@@ -15,7 +15,7 @@ if HAVE_SYSTEMD
systemdservicedir = $(systemdsystemunitdir)
systemdservice_DATA = $(systemdservice_in_files:.service.in=.service)
$(systemdservice_DATA): $(systemdservice_in_files) Makefile
@sed -e "s|\@libexecdir\@|$(libexecdir)|" $< > $@
@sed -e "s|\@libexecdir\@|$(libexecdir)|" -e "s|\@localstatedir\@|$(localstatedir)|" $< > $@
endif
polkitdir = $(datadir)/polkit-1/actions
......
......@@ -6,3 +6,23 @@ Documentation=man:fprintd(1)
Type=dbus
BusName=net.reactivated.Fprint
ExecStart=@libexecdir@/fprintd
# Filesystem lockdown
ProtectSystem=strict
ProtectKernelTunables=true
ProtectControlGroups=true
ReadWritePaths=@localstatedir@/lib/fprint
ProtectHome=true
PrivateTmp=true
# Network
PrivateNetwork=true
# Execute Mappings
MemoryDenyWriteExecute=true
# Modules
ProtectKernelModules=true
# Real-time
RestrictRealtime=true
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment