From b4170421cc58d8c57254f4224ba259e817f48869 Mon Sep 17 00:00:00 2001 From: intrigeri Date: Wed, 27 Aug 2014 03:18:26 +0000 Subject: [PATCH 1/2] systemd unit file: ensures that the process and all its children can never gain new privileges (#12939). --- contrib/dist/tor.service.in | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/dist/tor.service.in b/contrib/dist/tor.service.in index 2fe51c75d9..c4709a7fd6 100644 --- a/contrib/dist/tor.service.in +++ b/contrib/dist/tor.service.in @@ -19,6 +19,7 @@ PrivateTmp = yes DeviceAllow = /dev/null rw DeviceAllow = /dev/urandom r InaccessibleDirectories = /home +NoNewPrivileges = yes [Install] WantedBy = multi-user.target From a8dd279fa544145fb7ea66131e5f506889197ac6 Mon Sep 17 00:00:00 2001 From: intrigeri Date: Wed, 27 Aug 2014 03:19:40 +0000 Subject: [PATCH 2/2] Add changes file for #12939. --- changes/bug12939-systemd-no-new-privileges | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 changes/bug12939-systemd-no-new-privileges diff --git a/changes/bug12939-systemd-no-new-privileges b/changes/bug12939-systemd-no-new-privileges new file mode 100644 index 0000000000..d9103b7055 --- /dev/null +++ b/changes/bug12939-systemd-no-new-privileges @@ -0,0 +1,4 @@ + o Distribution: + - systemd unit file: ensures that the process and all its children + can never gain new privileges. + Patch by intrigeri; resolves ticket 12939.