6

There are many options available for Units (like services) in systemd. Three of them are called ReadWriteDirectories, ReadOnlyDirectories and InaccessibleDirectories. I'm using Debian 8.5 on a virtual machine. In some (newer?) versions of systemd they are called ReadWritePaths, ReadOnlyPaths and InaccessiblePaths. Can I use this options to whitelist directories, which should be accessible?

I have an application which is known to access some directories only. I would like to restrict the access to this directories. But it does not seem to have any effect if I use ReadWritePaths to specify this directories. The manpage says

Directories listed in ReadWriteDirectories= are accessible from within the namespace with the same access rights as from outside.

But directories not specified in this option seems to be accessible the same way. How to deny access to everything not specified? Or is it up to my system that it doesn't work? Someone could thing that it may be possible to use InaccessibleDirectories=/ to blacklist everything else but the manpage of a newer version, where the option is called InaccessiblePaths, says

Entries listed in InaccessiblePaths= will be made inaccessible for processes inside the namespace, and may not countain any other mountpoints, including those specified by ReadWritePaths= or ReadOnlyPaths=.

Well, is there a possibility to use ReadWriteDirectories and ReadOnlyDirectories to setup a whitelist of directories? If it is not possible, why does ReadWriteDirectories exist sinde it seems to do nothing?

4

ReadWritePaths and its ilk are only really useful when used alongside options that blacklist certain paths. If you know for a fact that your application should only be able to access certain paths, you can do some combination of the following:

  • Set ProtectSystem=strict, and whitelist particular directories for writing with ReadWritePaths.
  • Set ReadOnlyPaths, and whitelist particular directories with ReadWritePaths. If doing this with /, it does a superset of what ProtectSystem does (it also restricts /dev, /proc, and /sys, which you may not want). You can also use PrivateDevices, ProtectKernelTunables, and ProtectControlGroups to protect these directories.
  • 1
    Thanks for the answer. It looks like the documentation was improved as well. However, there is one open question: Is there a possibility to whitelist read access? It does not seem so. – JojOatXGME Feb 17 '17 at 23:27
0

Since you were specifically asking about whitelisting read access:

You might be able to achieve this with InaccessiblePaths, like so:

[Service]
...
InaccessiblePaths=/
ReadOnlyPaths=/etc/myapp.conf

See systemd.exec(5)

  • 1
    Thanks for your answer. I have already mentioned this setup in the question and quoted the documentation about it. According to this quote, it doesn't work. I also tested it before writing the question. However, I noticed that the documentation has changed a little bit since then. I don't know whether the behavior has changed in recent versions of Systemd. Have you tested it? – JojOatXGME Aug 18 '17 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.