haveged.service: Tighten-down security settings

[nbraud]

All changes were applied to init.d/service.fedora; I shipped them moments ago in Debian “sid” (a.k.a. unstable) as haveged/1.9.8-3.

• [x] Set SecureBits to prevent raising capabilities through execve(2)
• [x] Set PrivateTmp, so haveged gets its own /tmp and cannot access that of other services.
• [x] Set system-protection options `Protect{Home,Hostname,Kernel{Logs,Modules}}
• [x] Disable access to potentially-vulnerable kernel features (namespaces, personalities, realtime scheduling)
• [x] Enforce W^X (cannot have memory that is both writeable and executable)
• [x] Add a rather-restrictive syscall filter for the service

[jirka-h]

Hi Nicholas,

the SystemCallFilter seems to be too restrictive - service is failing os some architectures. Please see:

https://github.com/jirka-h/haveged/issues/41

I'm not sure how to effectively debug this and to find out which service is missing. Could you please help?

Thanks a lot! Jirka