From 1ac3b74405098d6cace271e0c5c6b0cf33ba0154 Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Fri, 28 Nov 2014 12:36:17 -0500 Subject: [PATCH 1/4] Use PrivateDevices instead of DeviceAllow See 13805 --- contrib/dist/tor.service.in | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/contrib/dist/tor.service.in b/contrib/dist/tor.service.in index 57409a7b0a..63628553dd 100644 --- a/contrib/dist/tor.service.in +++ b/contrib/dist/tor.service.in @@ -16,8 +16,7 @@ LimitNOFILE = 32768 # Hardening PrivateTmp = yes -DeviceAllow = /dev/null rw -DeviceAllow = /dev/urandom r +PrivateDevices = yes InaccessibleDirectories = /home ReadOnlyDirectories = / ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor From 9c933b3635d9d7e30ff43494aa4efac65ab99b16 Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Fri, 28 Nov 2014 12:36:56 -0500 Subject: [PATCH 2/4] Use ProtectHome instead of InaccessibleDirectories See 13805 --- contrib/dist/tor.service.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/dist/tor.service.in b/contrib/dist/tor.service.in index 63628553dd..0e1e6cce40 100644 --- a/contrib/dist/tor.service.in +++ b/contrib/dist/tor.service.in @@ -17,7 +17,7 @@ LimitNOFILE = 32768 # Hardening PrivateTmp = yes PrivateDevices = yes -InaccessibleDirectories = /home +ProtectHome = yes ReadOnlyDirectories = / ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor ReadWriteDirectories = @LOCALSTATEDIR@/log/tor From 0c73bcd3ba7f5fb724a4ecb9f2057a40dd1a2582 Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Fri, 28 Nov 2014 12:38:40 -0500 Subject: [PATCH 3/4] Prefix ReadWriteDirectories with a "-" so if they don't exist it's not an error See 13805 --- contrib/dist/tor.service.in | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/contrib/dist/tor.service.in b/contrib/dist/tor.service.in index 0e1e6cce40..5cd460e383 100644 --- a/contrib/dist/tor.service.in +++ b/contrib/dist/tor.service.in @@ -19,9 +19,9 @@ PrivateTmp = yes PrivateDevices = yes ProtectHome = yes ReadOnlyDirectories = / -ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor -ReadWriteDirectories = @LOCALSTATEDIR@/log/tor -ReadWriteDirectories = @LOCALSTATEDIR@/run/tor +ReadWriteDirectories = -@LOCALSTATEDIR@/lib/tor +ReadWriteDirectories = -@LOCALSTATEDIR@/log/tor +ReadWriteDirectories = -@LOCALSTATEDIR@/run/tor NoNewPrivileges = yes [Install] From 5bdf12ca8aa13cd98c6a4b7457b37df2b519e8a7 Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Fri, 28 Nov 2014 12:41:23 -0500 Subject: [PATCH 4/4] Add ProtectSystem = full See 13805 --- contrib/dist/tor.service.in | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/dist/tor.service.in b/contrib/dist/tor.service.in index 5cd460e383..b052405aea 100644 --- a/contrib/dist/tor.service.in +++ b/contrib/dist/tor.service.in @@ -18,6 +18,7 @@ LimitNOFILE = 32768 PrivateTmp = yes PrivateDevices = yes ProtectHome = yes +ProtectSystem = full ReadOnlyDirectories = / ReadWriteDirectories = -@LOCALSTATEDIR@/lib/tor ReadWriteDirectories = -@LOCALSTATEDIR@/log/tor