globaleaks / whistleblowing-software

GlobaLeaks is free, open-source whistleblowing software enabling anyone to easily set up and maintain a secure reporting platform.
https://www.globaleaks.org
Other
1.22k stars 267 forks source link

Improve Hardening on Linux: Dropping capabilities #125

Open fpietrosanti opened 11 years ago

fpietrosanti commented 11 years ago

To further improve the GlobaLeaks security on Linux, this ticket is to drop all the non-required Linux capabilities.

The dropping of capabilities on Linux can be down with PrCtl: http://pythonhosted.org/python-prctl/

fpietrosanti commented 11 years ago

Dropping of capabilities could be also done with shell commands, from within the init script

http://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l

stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l