I am trying to harden some services on my servers.
For this purpose, I have been using systemctl service configuration. For a given service, I run for instance
strace to determine the system calls used on normal operations to create a systemcalls whitelist. Here is my openvpn.service configuration :
[Unit] Description=a given service I want to restrict systemcalls After=syslog.target network-online.target Wants=network-online.target Documentation=man:openvpn(8) service [Service] Type=notify LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw KillMode=process RestartSec=5s Restart=on-failure ExecStart=/usr/sbin/openvpn --config /etc/openvpn/server/vpn.conf ProtectHome=yes User=openvpn Group=openvpn SystemCallFilter= CapabilityBoundingSet=CAP_NET_ADMIN AmbientCapabilities=CAP_NET_ADMIN ProtectSystem=strict PrivateTmp=yes #PrivateDevices=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_INET NoNewPrivileges=yes ProtectKernelModules=yes ProtectKernelTunables=yes ProtectControlGroups=yes MemoryDenyWriteExecute=yes [Install] WantedBy=multi-user.target
By running it on command line with strace, I know that for instance at least
recvfrom systemcalls are being used. However, when I empty the SystemCallFilter (
SystemCallFilter=), the service still can be loaded and runs as usual.
So is this option really being taken into account (and maybe I just made a typo, for instance, this is not the right syntax to forbid everything) ? Or maybe this option only gets applied for the service which launches
openvpn and not
openvpn process itself ?
The fact is, I would like to use this feature, but I don't know any way to check it really does what it is supposed to do : allow only listed systemcalls.
Thank for your help!