1

I am trying to harden some services on my servers.

For this purpose, I have been using systemctl service configuration. For a given service, I run for instance strace to determine the system calls used on normal operations to create a systemcalls whitelist. Here is my openvpn.service configuration :

[Unit]
Description=a given service I want to restrict systemcalls
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8) service

[Service]
Type=notify
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
KillMode=process
RestartSec=5s
Restart=on-failure
ExecStart=/usr/sbin/openvpn --config /etc/openvpn/server/vpn.conf
ProtectHome=yes
User=openvpn
Group=openvpn
SystemCallFilter=
CapabilityBoundingSet=CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_ADMIN
ProtectSystem=strict
PrivateTmp=yes
#PrivateDevices=yes
RestrictNamespaces=yes
RestrictAddressFamilies=AF_INET
NoNewPrivileges=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
MemoryDenyWriteExecute=yes
[Install]
WantedBy=multi-user.target

By running it on command line with strace, I know that for instance at least sendto and recvfrom systemcalls are being used. However, when I empty the SystemCallFilter (SystemCallFilter=), the service still can be loaded and runs as usual.

So is this option really being taken into account (and maybe I just made a typo, for instance, this is not the right syntax to forbid everything) ? Or maybe this option only gets applied for the service which launches openvpn and not openvpn process itself ?

The fact is, I would like to use this feature, but I don't know any way to check it really does what it is supposed to do : allow only listed systemcalls.

Thank for your help!

1

By running it on command line with strace, I know that for instance at least sendto and recvfrom systemcalls are being used. However, when I empty the SystemCallFilter (SystemCallFilter=), the service still can be loaded and runs as usual.


CapabilityBoundingSet=CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_ADMIN

Answer

These two chunks of your question(above) kind of answers why your OpenVPN service is having access to all needed syscalls.

First: SystemCallFilter= does not block all syscalls. Manpage:

Note that the execve, exit, exit_group, getrlimit, rt_sigreturn, sigreturn system calls and the system calls for querying time and sleeping are implicitly whitelisted and do not need to be listed explicitly.

Second: If you take a look at socket(7) manpage, you will see that pretty much all socket related syscalls(including sendto and recvfrom) and network interface manipulation features can be acessed if CAP_NET_ADMIN is set to a process/file. capabilities(7) manpage:

   CAP_NET_ADMIN
          Perform various network-related operations:
          * interface configuration;
          * administration of IP firewall, masquerading, and accounting;
          * modify routing tables;
          * bind to any address for transparent proxying;
          * set type-of-service (TOS)
          * clear driver statistics;
          * set promiscuous mode;
          * enabling multicasting;
          * use setsockopt(2) to set the following socket options:
            SO_DEBUG, SO_MARK, SO_PRIORITY (for a priority outside the
            range 0 to 6), SO_RCVBUFFORCE, and SO_SNDBUFFORCE.

Third: NoNewPrivileges= will be ignored by SystemCallFilter=, SystemCallArchitectures=, RestrictAddressFamilies=, RestrictNamespaces=, PrivateDevices=, ProtectKernelTunables=, ProtectKernelModules=, MemoryDenyWriteExecute=, RestrictRealtime=, or LockPersonality= options. Take a look at the manpage above.

If you take a look at the documentation, you will see that systemd is full of caveats so, my guess here is that even if you are not allowing those syscalls, they are part of CAP_NET_ADMIN.

You can use systemd-analyze syscall-filter to double-check your openvpn service.

  • thanks for your answer! Just a little question if I may: how systemd-analyze syscall-filter can be used to audit and check if specified settings are truly aplied to my openvpn service ? – philippe Aug 3 '18 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.