Skip to content

Commit

Permalink
Add more security flogs to service
Browse files Browse the repository at this point in the history
  • Loading branch information
@lkck24
lkck24 committed Oct 5, 2023
1 parent e5ae64c commit 228e4fe
Show file tree
Hide file tree
Showing 2 changed files with 55 additions and 4 deletions.
32 changes: 28 additions & 4 deletions REFERENCE.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2416,15 +2416,39 @@ Struct[{
Optional['OOMPolicy'] => Enum['continue', 'stop','kill'],
Optional['OOMScoreAdjust'] => Integer[-1000,1000],
Optional['Environment'] => String,
Optional['EnvironmentFile'] => Variant[
Stdlib::Unixpath,Pattern[/-\/.+/],
Array[Variant[Stdlib::Unixpath,Pattern[/-\/.+/]],1],
],
Optional['EnvironmentFile'] => Variant[Stdlib::Unixpath,Pattern[/-\/.+/], Array[Variant[Stdlib::Unixpath,Pattern[/-\/.+/]],1]],
Optional['StandardOutput'] => Variant[Enum['inherit','null','tty','journal','kmsg','journal+console','kmsg+console','socket'],Pattern[/\A(file:|append:|truncate:).+$\z/]],
Optional['StandardError'] => Variant[Enum['inherit','null','tty','journal','kmsg','journal+console','kmsg+console','socket'],Pattern[/\A(file:|append:|truncate:).+$\z/]],
Optional['StandardInput'] => Variant[Enum['null','tty','tty-force','tty-fail','data','socket'], Pattern[/\A(file:|fd:).+$\z/]],
Optional['PrivateTmp'] => Boolean,
Optional['RuntimeDirectory'] => String,
Optional['RuntimeDirectoryMode'] => Stdlib::Filemode,
Optional['LogsDirectory'] => String,
Optional['LogsDirectoryMode'] => Stdlib::Filemode,
Optional['ProtectSystem'] => Variant[Boolean, Enum['full', 'strict']],
Optional['ProtectHome'] => Variant[Boolean, Enum['read-only', 'tmpfs']],
Optional['BindPaths'] => Variant[Stdlib::Unixpath,Pattern[/-\/.+/], Array[Variant[Stdlib::Unixpath,Pattern[/-\/.+/]],1]],
Optional['BindReadOnlyPaths'] => Variant[Stdlib::Unixpath,Pattern[/-\/.+/], Array[Variant[Stdlib::Unixpath,Pattern[/-\/.+/]],1]],
Optional['PrivateDevices'] => Boolean,
Optional['RemoveIPC'] => Boolean,
Optional['ProtectKernelModules'] => Boolean,
Optional['ProtectKernelTunables'] => Boolean,
Optional['ProtectControlGroups'] => Boolean,
Optional['RestrictRealtime'] => Boolean,
Optional['RestrictAddressFamilies'] => Variant[Enum['AF_UNIX', 'AF_INET', 'AF_INET6', 'AF_NETLINK', 'none'], Array[Enum['AF_UNIX', 'AF_INET', 'AF_INET6', 'AF_NETLINK', 'none']]],
Optional['RestrictNamespaces'] => Variant[Boolean, Enum['ipc', 'net', 'mnt', 'pid', 'user', 'uts', 'cgroup'], Array[Enum['ipc', 'net', 'mnt', 'pid', 'user', 'uts', 'cgroup']]],
Optional['SystemCallArchitectures'] => Variant[String, Array[String]],
Optional['SystemCallFilter'] => Variant[String, Array[String]],
Optional['SystemCallErrorNumber'] => String,
Optional['ProtectClock'] => Boolean,
Optional['PrivateUsers'] => Boolean,
Optional['ProtectKernelLogs'] => Boolean,
Optional['ProtectProc'] => Enum['noaccess', 'invisible', 'ptraceable', 'default'],
Optional['ProtectHostname'] => Boolean,
Optional['RestrictSUIDSGID'] => Boolean,
Optional['CapabilityBoundingSet'] => Variant[String, Array[String]],
Optional['NoNewPrivileges'] => Boolean,
Optional['LockPersonality'] => Boolean,
}]
```

Expand Down
27 changes: 27 additions & 0 deletions types/unit/service.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -102,5 +102,32 @@
Optional['StandardInput'] => Variant[Enum['null','tty','tty-force','tty-fail','data','socket'], Pattern[/\A(file:|fd:).+$\z/]],
Optional['PrivateTmp'] => Boolean,
Optional['RuntimeDirectory'] => String,
Optional['RuntimeDirectoryMode'] => Stdlib::Filemode,
Optional['LogsDirectory'] => String,
Optional['LogsDirectoryMode'] => Stdlib::Filemode,
Optional['ProtectSystem'] => Variant[Boolean, Enum['full', 'strict']],
Optional['ProtectHome'] => Variant[Boolean, Enum['read-only', 'tmpfs']],
Optional['BindPaths'] => Variant[Stdlib::Unixpath,Pattern[/-\/.+/], Array[Variant[Stdlib::Unixpath,Pattern[/-\/.+/]],1]],
Optional['BindReadOnlyPaths'] => Variant[Stdlib::Unixpath,Pattern[/-\/.+/], Array[Variant[Stdlib::Unixpath,Pattern[/-\/.+/]],1]],
Optional['PrivateDevices'] => Boolean,
Optional['RemoveIPC'] => Boolean,
Optional['ProtectKernelModules'] => Boolean,
Optional['ProtectKernelTunables'] => Boolean,
Optional['ProtectControlGroups'] => Boolean,
Optional['RestrictRealtime'] => Boolean,
Optional['RestrictAddressFamilies'] => Variant[Enum['AF_UNIX', 'AF_INET', 'AF_INET6', 'AF_NETLINK', 'none'], Array[Enum['AF_UNIX', 'AF_INET', 'AF_INET6', 'AF_NETLINK', 'none']]],
Optional['RestrictNamespaces'] => Variant[Boolean, Enum['ipc', 'net', 'mnt', 'pid', 'user', 'uts', 'cgroup'], Array[Enum['ipc', 'net', 'mnt', 'pid', 'user', 'uts', 'cgroup']]],
Optional['SystemCallArchitectures'] => Variant[String, Array[String]],
Optional['SystemCallFilter'] => Variant[String, Array[String]],
Optional['SystemCallErrorNumber'] => String,
Optional['ProtectClock'] => Boolean,
Optional['PrivateUsers'] => Boolean,
Optional['ProtectKernelLogs'] => Boolean,
Optional['ProtectProc'] => Enum['noaccess', 'invisible', 'ptraceable', 'default'],
Optional['ProtectHostname'] => Boolean,
Optional['RestrictSUIDSGID'] => Boolean,
Optional['CapabilityBoundingSet'] => Variant[String, Array[String]],
Optional['NoNewPrivileges'] => Boolean,
Optional['LockPersonality'] => Boolean,
}
]

0 comments on commit 228e4fe

Please sign in to comment.