Welcome! Log In Create A New Profile

Advanced

nginx: sandboxing

Anonymous User
May 12, 2021 08:44AM
Здравствуйте.
SystemD поддерживает возможность запуска сервисов в режиме песочницы. В параметрах есть опция RemoveIPC - https://www.freedesktop.org/software/systemd/man/systemd.exec.html#RemoveIPC=
Приложение nginx использует IPC вызовы? Можно ли фильтровать эти события, а так же системные вызовы @ipc - https://www.freedesktop.org/software/systemd/man/systemd.exec.html#SystemCallFilter=
Набор фильтров @ipc фильруется такие системные вызовы:
```
# SysV IPC, POSIX Message Queues or other IPC
ipc
memfd_create
mq_getsetattr
mq_notify
mq_open
mq_timedreceive
mq_timedreceive_time64
mq_timedsend
mq_timedsend_time64
mq_unlink
msgctl
msgget
msgrcv
msgsnd
pipe
pipe2
process_vm_readv
process_vm_writev
semctl
semget
semop
semtimedop
semtimedop_time64
shmat
shmctl
shmdt
shmget
```
В коде nginx используются эти вызовы?
Тут - https://github.com/nginx/nginx/blob/master/src/event/ngx_event_pipe.c#L119 вроде используется вызов pipe. Или это разные вещи?

nginx.service:
```
AmbientCapabilities=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_SYS_RESOURCE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_SYS_RESOURCE
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateMounts=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=true
RestrictAddressFamilies=AF_UNIX
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid
UMask=0027
```


--
С уважением,
Izorkin mailto:izorkin@gmail.com

_______________________________________________
nginx-ru mailing list
nginx-ru@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-ru
Subject Author Posted

nginx: sandboxing

Anonymous User May 12, 2021 08:44AM

Re: nginx: sandboxing

Илья Шипицин May 12, 2021 11:40AM

Re: nginx: sandboxing

Anonymous User May 12, 2021 12:46PM

Re: nginx: sandboxing

Илья Шипицин May 12, 2021 12:56PM

Re: nginx: sandboxing

Maxim Konovalov May 12, 2021 01:14PM

Re: nginx: sandboxing

Илья Шипицин May 12, 2021 01:28PM

Re: nginx: sandboxing

Maxim Konovalov May 12, 2021 01:34PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 82
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready