From c106dbd095cddb3254ab85eca99bdaa997db2ca3 Mon Sep 17 00:00:00 2001 From: tugy <33746108+tugytur@users.noreply.github.com> Date: Thu, 28 Mar 2024 15:07:52 +0100 Subject: [PATCH] add missing syscalls for workers (#2212) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit # Description Since the binary split additional syscalls are getting blocked in relation to the workers. With the hardened systemd file it shows the following warning: ``` Cannot fully enable landlock, a Linux kernel security feature. Running validation of malicious PVF code has a higher risk of compromising this machine. Consider upgrading the kernel version for maximum security. status=Ok(NotEnforced) abi=1 ``` For it to work we need to allow additionally: - mount - umount2 - pivot_root and set `RestrictNamespaces=false` Added new line `SystemCallFilter=pivot_root` because otherwise it would get blocked by ~\@\privileged Co-authored-by: s0me0ne-unkn0wn <48632512+s0me0ne-unkn0wn@users.noreply.github.com> Co-authored-by: Bastian Köcher <git@kchr.de> --- polkadot/scripts/packaging/polkadot.service | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/polkadot/scripts/packaging/polkadot.service b/polkadot/scripts/packaging/polkadot.service index 7fb549c97f8..8c5a483d424 100644 --- a/polkadot/scripts/packaging/polkadot.service +++ b/polkadot/scripts/packaging/polkadot.service @@ -25,12 +25,13 @@ ProtectKernelTunables=true ProtectSystem=strict RemoveIPC=true RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX -RestrictNamespaces=true +RestrictNamespaces=false RestrictSUIDSGID=true SystemCallArchitectures=native SystemCallFilter=@system-service -SystemCallFilter=landlock_add_rule landlock_create_ruleset landlock_restrict_self seccomp -SystemCallFilter=~@clock @module @mount @reboot @swap @privileged +SystemCallFilter=landlock_add_rule landlock_create_ruleset landlock_restrict_self seccomp mount umount2 +SystemCallFilter=~@clock @module @reboot @swap @privileged +SystemCallFilter=pivot_root UMask=0027 [Install] -- GitLab