From c9f30c4512fa6409eaf829c8448c8e086271c94f Mon Sep 17 00:00:00 2001 From: intrigeri Date: Wed, 27 Aug 2014 03:05:12 +0000 Subject: [PATCH 1/2] systemd unit file: only allow tor to write to /var/lib/tor and /var/log/tor (#12751). The rest of the filesystem is accessible for reading only. Still, quoting systemd.exec(5): Note that restricting access with these options does not extend to submounts of a directory that are created later on. --- contrib/dist/tor.service.in | 3 +++ 1 file changed, 3 insertions(+) diff --git a/contrib/dist/tor.service.in b/contrib/dist/tor.service.in index 2fe51c75d9..8c70ccc6e3 100644 --- a/contrib/dist/tor.service.in +++ b/contrib/dist/tor.service.in @@ -19,6 +19,9 @@ PrivateTmp = yes DeviceAllow = /dev/null rw DeviceAllow = /dev/urandom r InaccessibleDirectories = /home +ReadOnlyDirectories = / +ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor +ReadWriteDirectories = @LOCALSTATEDIR@/log/tor [Install] WantedBy = multi-user.target From 9f0161f73db38ab0cf849dcca66f645d3036d9a9 Mon Sep 17 00:00:00 2001 From: intrigeri Date: Wed, 27 Aug 2014 03:13:32 +0000 Subject: [PATCH 2/2] Add changes file for #12751. --- changes/bug12751-systemd-filesystem-sandbox | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 changes/bug12751-systemd-filesystem-sandbox diff --git a/changes/bug12751-systemd-filesystem-sandbox b/changes/bug12751-systemd-filesystem-sandbox new file mode 100644 index 0000000000..0abaa4cf6f --- /dev/null +++ b/changes/bug12751-systemd-filesystem-sandbox @@ -0,0 +1,5 @@ + o Distribution: + - systemd unit file: only allow tor to write to /var/lib/tor + and /var/log/tor. The rest of the filesystem is accessible + for reading only. + Patch by intrigeri; resolves ticket 12751.