rust-u2f icon indicating copy to clipboard operation
rust-u2f copied to clipboard

Published 20 hours ago • verified publisher icon danstiner

Restrict systemd units as much as possible

Open danstiner opened this issue 7 years ago • 1 comments

A number of good ideas in: http://0pointer.net/public/systemd-nluug-2014.pdf

Should be as simple as trying each mitigation and see which can be enabled without breaking anything.

Possibly more in the following presentation: http://ftp.nluug.nl/video/nluug/2014-11-20_nj14/zaal-2/5_Lennart_Poettering_-_Systemd.webm

danstiner avatar Dec 28 '17 06:12 danstiner

The system daemon probably doesn't really need to run as root (which the client currently checks for -- needlessly, AFAICT). If the system daemon gets handed an open file descriptor to /dev/uhid, that's about all the privileges it needs (and handing on that FD can probably be done in the systemd unit).

chrysn avatar Jul 16 '22 16:07 chrysn