Repository navigation
Conversation
Instead of running as root we should really prefer to run unprivileged. This can be done by using the DynamicUser=yes in the unit and by having a polkit rule that allows the bridge to talk to the various varlink services. This is hardening, effectively the bridge is still root because it can start processes as root via varlink. The other nice benefit of it is that by using polkit we can potentially limit the usage more fine-grained. We also plan to add more features to polkit and systemd to carry more information from the bridge so that we can take data from the bridge authentication into account when making the authorization decisions.
d5103a2 to
864f659
Compare
| # Nothing in the bridge needs root: every privileged operation happens in the | ||
| # varlink service on the other side of the socket, which authorizes the caller | ||
| # via polkit. | ||
| DynamicUser=yes |
There was a problem hiding this comment.
Does this work with regard to early boot ordering? The socket unit says "the bridge is reachable for remote management while systemd-firstboot.service may still be blocking". Will dbus be up at that point to do the authentication for bridge requests at that point? If not, we should point this out somewhere in the readme.
| DynamicUser=yes | ||
| # systemd-journal for journal access, varlink-httpd for the secrets in | ||
| # /etc/varlink-httpd/, which the transient uid cannot own. | ||
| SupplementaryGroups=systemd-journal varlink-httpd |
There was a problem hiding this comment.
Another potential ordering problem: varlink-httpd group may only exist after systemd-sysusers.service has run, but the unit as DefaultDependencies=no and no After=systemd-sysusers.service, so early calls might fail if the group doesn't exist. Restart=on-failure probably recovers it eventually.
| hopefully can carry more information from the bridge to polkit for | ||
| decisions. | ||
|
|
||
| Important to know: |
There was a problem hiding this comment.
We should point out here that some services are unreachable with this default configuration. systemd-bootctl, systemd-repart, systemd-pcrlock, systemd-udevd-varlink, systemd-report and sysupdate-notify sockets come with 0644 by default. And there are also the methods that check uid == 0. I think the other PR mentions it, but might be nice to have a clear list we keep up to date.
| sysusersdir := prefix / "lib/sysusers.d" | ||
| tmpfilesdir := prefix / "lib/tmpfiles.d" |
There was a problem hiding this comment.
We now install these but never run systemd-sysusers or systemd-tmpfiles --create. I'm not a user of "install" commands, so I don't know what exactly the expectations there are.
|
|
||
| # without this rule polkit denies the DynamicUser every privileged varlink call | ||
| install_polkit: | ||
| install -Dm644 data/10-varlink-httpd.rules {{destdir}}{{polkitrulesdir}}/10-varlink-httpd.rules |
There was a problem hiding this comment.
10- might be a bit high priority for a default rule? Not to familiar with the conventions..
| if (subject.system_unit === "varlink-httpd.service") { | ||
| return polkit.Result.YES; | ||
| } |
There was a problem hiding this comment.
rule doesn't check no_new_privileges, also see comments on the rule, dbus access etc in the other PR.
|
|
||
| # The bridge runs with DynamicUser=yes and many varlink call need | ||
| # to be authorized by polkit | ||
| Requires: polkit |
There was a problem hiding this comment.
| Requires: polkit | |
| Requires: polkit >= 124 |
I'm no expert when it comes to rpm packaging, but I think you can do something like this?
2 participants
Instead of running as root we should really prefer to run unprivileged. This can be done by using the DynamicUser=yes in the unit and by having a polkit rule that allows the bridge to talk to the various varlink services.
This is hardening, effectively the bridge is still root because it can start processes as root via varlink. The other nice benefit of it is that by using polkit we can potentially limit the usage more fine-grained. We also plan to add more features to polkit and systemd to carry more information from the bridge so that we can take data from the bridge authentication into account when making the authorization decisions.
Fwiw, if we can get polkit-org/polkit#712 merged this becomes much more useful.