Harden and update to use the new features in systemd-232

[spacekitteh]

Once systemd-232 is merged (#20156) and things are working, we have a bunch of tasks:

• [ ] Set defaults for services to abide by the principle of least privilege (#14645)
  • [ ] ProtectKernelModules = true;
  • [ ] ProtectSystem = "strict";
  • [ ] ProtectKernelTunables = true;
  • [ ] ProtectControlGroups = true;
  • [ ] DynamicUser = true; (#11908) Requires enabling the new nss-systemd.so module. Also means going through all current services to remove now-unrequired users.
  • [ ] NoNewPrivileges = true;
  • [ ] RestrictAddressFamilies. This takes a list of address families to whitelist, but the default should be empty.
• [ ] RemoveIPC option to remove assigned IPC objects after service exit
• [ ] Include the two new user targets: "graphical-session.target" and "graphical-session-pre.target"
• [ ] Ensure Journald's SplitMode has been changed to "uid", as "login" is now deprecated
• [ ] Update cryptsetup/crypttab to enable enable VeraCrypt partitions

[peterhoeg]

This is the best practice list from the mailing list:

CapabilityBoundingSet=...
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=strict
RestrictAddressFamilies=AF_NETLINK AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources

[globin]

systemd 232 is on staging (a38f1911d34f2a72e15d5e98d76bece6cb8042a8)

[ckauhaus]

We are on systemd-239 now. Is this still relevant?

[peterhoeg]

Very much so - we are not really making use of the various capabilities to lock things down (yet).