diff --git a/src/pcp/atop/atop-daily.service b/src/pcp/atop/atop-daily.service index e40463c3392..5668d88759d 100644 --- a/src/pcp/atop/atop-daily.service +++ b/src/pcp/atop/atop-daily.service @@ -9,3 +9,17 @@ Type=oneshot # compression and culls old archives before recording resumes on the new # date-stamped archive. Compression runs in parallel with recording. ExecStart=systemctl restart atop.service +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private diff --git a/src/pcp/atop/atop.service.in b/src/pcp/atop/atop.service.in index 01faaf77306..be9a60df208 100644 --- a/src/pcp/atop/atop.service.in +++ b/src/pcp/atop/atop.service.in @@ -14,6 +14,23 @@ EnvironmentFile=-@PCP_SYSCONFIG_DIR@/atop ExecStartPre=@PCP_BINADM_DIR@/atop-daily ExecStart=/bin/sh -c 'exec @PCP_BINADM_DIR@/pcp-atop ${LOGOPTS} -w "${LOGPATH}" ${LOGINTERVAL}' KillSignal=SIGTERM +# Hardening: no SystemCallFilter (performance impact); needs /proc access. +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +PrivateTmp=yes +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private [Install] WantedBy=multi-user.target diff --git a/src/pcp/geolocate/pcp-geolocate.service.in b/src/pcp/geolocate/pcp-geolocate.service.in index f70dd4bd29a..86c91f23c54 100644 --- a/src/pcp/geolocate/pcp-geolocate.service.in +++ b/src/pcp/geolocate/pcp-geolocate.service.in @@ -9,6 +9,22 @@ Type=oneshot ExecStart=@PCP_BINADM_DIR@/pcp-geolocate @PCP_SYSCONF_DIR@/labels/optional/geolocate Group=root User=root +# Hardening: no SystemCallFilter (performance impact). +PrivateTmp=yes +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private [Install] WantedBy=multi-user.target diff --git a/src/pmcd/pmcd.service.in b/src/pmcd/pmcd.service.in index f9d2fb9a935..c430518dc96 100644 --- a/src/pmcd/pmcd.service.in +++ b/src/pmcd/pmcd.service.in @@ -11,6 +11,25 @@ Restart=always ExecStart=@PCP_RC_DIR@/pmcd start-systemd ExecStop=@PCP_RC_DIR@/pmcd stop-systemd PIDFile=@PCP_RUN_DIR@/pmcd.pid +# Hardening: no SystemCallFilter (performance); NoNewPrivileges omitted +# because pmcd drops to the pcp user via setuid after startup. +# ProtectHostname omitted so pmcd can detect hostname changes and +# propagate PMCD_HOSTNAME_CHANGE to pmlogger, pmie, and other clients. +# UMask omitted (leave systemd default): PMDA Install/make under +# /var/lib/pcp/pmdas must create world-readable/executable artifacts +# for local contexts and QA (UMask=0027 breaks e.g. sample PMDA). +# ProtectKernelModules and RestrictNamespaces omitted so the dm PMDA +# can ioctl /dev/mapper/control and run dmsetup (qa/359, LVM hosts). +# ProtectControlGroups, ProtectClock and RestrictSUIDSGID omitted so +# the dm PMDA can access device-mapper cgroups and run dmsetup +# (qa/359, Ubuntu CI). +ProtectHome=yes +ProtectKernelLogs=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +LockPersonality=yes +SystemCallArchitectures=native +KeyringMode=private [Install] WantedBy=multi-user.target diff --git a/src/pmfind/pmfind.service.in b/src/pmfind/pmfind.service.in index 2eb7eeafc5e..7d5318217b2 100644 --- a/src/pmfind/pmfind.service.in +++ b/src/pmfind/pmfind.service.in @@ -13,6 +13,23 @@ Environment="PMFIND_CHECK_PARAMS=-C -q" EnvironmentFile=-@PCP_SYSCONFIG_DIR@/pmfind ExecStart=@PCP_BINADM_DIR@/pmfind_check $PMFIND_CHECK_PARAMS WorkingDirectory=@PCP_VAR_DIR@ +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +PrivateTmp=yes +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private [Install] WantedBy=multi-user.target diff --git a/src/pmie/pmie.service.in b/src/pmie/pmie.service.in index b8705c44f7a..cc3150492ae 100644 --- a/src/pmie/pmie.service.in +++ b/src/pmie/pmie.service.in @@ -20,6 +20,21 @@ ExecStop=@PCP_SERVICES_DIR@/pmie stop-systemd PIDFile=@PCP_RUN_DIR@/pmie.pid Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private [Install] WantedBy=multi-user.target diff --git a/src/pmie/pmie_check.service.in b/src/pmie/pmie_check.service.in index 6ec7950d36e..1e2e3cb5029 100644 --- a/src/pmie/pmie_check.service.in +++ b/src/pmie/pmie_check.service.in @@ -14,3 +14,18 @@ ExecStart=@PCP_BINADM_DIR@/pmie_check $PMIE_CHECK_PARAMS WorkingDirectory=@PCP_VAR_DIR@ Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private diff --git a/src/pmie/pmie_daily.service.in b/src/pmie/pmie_daily.service.in index c2c908e4679..a624f6b1b95 100644 --- a/src/pmie/pmie_daily.service.in +++ b/src/pmie/pmie_daily.service.in @@ -13,3 +13,19 @@ ExecStart=@PCP_BINADM_DIR@/pmie_daily $PMIE_DAILY_PARAMS WorkingDirectory=@PCP_VAR_DIR@ Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +PrivateTmp=yes +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private diff --git a/src/pmie/pmie_farm.service.in b/src/pmie/pmie_farm.service.in index e119388b4b9..20ffe6426fa 100644 --- a/src/pmie/pmie_farm.service.in +++ b/src/pmie/pmie_farm.service.in @@ -18,6 +18,24 @@ ExecStart=@PCP_BINADM_DIR@/pmie_farm $PMIE_CHECK_PARAMS WorkingDirectory=@PCP_VAR_DIR@ Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +# PrivateTmp omitted so farm instances can write to log paths from +# control files (e.g. under /tmp in QA, or user-configured locations). +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private [Install] RequiredBy=pmie.service diff --git a/src/pmie/pmie_farm_check.service.in b/src/pmie/pmie_farm_check.service.in index 94f3456b371..ec1259c0ce1 100644 --- a/src/pmie/pmie_farm_check.service.in +++ b/src/pmie/pmie_farm_check.service.in @@ -13,3 +13,20 @@ TimeoutStopSec=120 # User= nor Group= here ExecStart=@PCP_BIN_DIR@/pmiectl -m check WorkingDirectory=@PCP_VAR_DIR@ +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +# NoNewPrivileges omitted because pmiectl uses runaspcp (setuid). +PrivateTmp=yes +ProtectHome=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private diff --git a/src/pmlogger/pmlogger.service.in b/src/pmlogger/pmlogger.service.in index 20d2dca4c2c..9aaa3c8095c 100644 --- a/src/pmlogger/pmlogger.service.in +++ b/src/pmlogger/pmlogger.service.in @@ -20,6 +20,21 @@ ExecStop=@PCP_SERVICES_DIR@/pmlogger stop-systemd PIDFile=@PCP_RUN_DIR@/pmlogger.pid Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private [Install] WantedBy=multi-user.target diff --git a/src/pmlogger/pmlogger_check.service.in b/src/pmlogger/pmlogger_check.service.in index 8c4e20d594f..69f61116ccd 100644 --- a/src/pmlogger/pmlogger_check.service.in +++ b/src/pmlogger/pmlogger_check.service.in @@ -15,3 +15,18 @@ ExecStart=@PCP_BINADM_DIR@/pmlogger_check --noerror $PMLOGGER_CHECK_PARAMS WorkingDirectory=@PCP_VAR_DIR@ Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private diff --git a/src/pmlogger/pmlogger_daily.service.in b/src/pmlogger/pmlogger_daily.service.in index 2c67e18d27b..257306f1b9a 100644 --- a/src/pmlogger/pmlogger_daily.service.in +++ b/src/pmlogger/pmlogger_daily.service.in @@ -13,3 +13,19 @@ ExecStart=@PCP_BINADM_DIR@/pmlogger_daily --noerror -P $PMLOGGER_DAILY_PARAMS WorkingDirectory=@PCP_VAR_DIR@ Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +PrivateTmp=yes +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private diff --git a/src/pmlogger/pmlogger_farm.service.in b/src/pmlogger/pmlogger_farm.service.in index 9b63f7fa925..45e7617feb9 100644 --- a/src/pmlogger/pmlogger_farm.service.in +++ b/src/pmlogger/pmlogger_farm.service.in @@ -18,6 +18,24 @@ ExecStart=@PCP_BINADM_DIR@/pmlogger_farm $PMLOGGER_CHECK_PARAMS WorkingDirectory=@PCP_VAR_DIR@ Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +# PrivateTmp omitted so farm instances can write to log paths from +# control files (e.g. under /tmp in QA, or user-configured locations). +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private [Install] RequiredBy=pmlogger.service diff --git a/src/pmlogger/pmlogger_farm_check.service.in b/src/pmlogger/pmlogger_farm_check.service.in index 260f5a1aebb..2ef1e102698 100644 --- a/src/pmlogger/pmlogger_farm_check.service.in +++ b/src/pmlogger/pmlogger_farm_check.service.in @@ -16,3 +16,20 @@ TimeoutStopSec=120 # known to pmlogctl(1) ExecStart=@PCP_BIN_DIR@/pmlogctl -m check WorkingDirectory=@PCP_VAR_DIR@ +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +# NoNewPrivileges omitted because pmlogctl uses runaspcp (setuid). +PrivateTmp=yes +ProtectHome=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private diff --git a/src/pmproxy/pmproxy.service.in b/src/pmproxy/pmproxy.service.in index 7c15929a25c..ca41698a519 100644 --- a/src/pmproxy/pmproxy.service.in +++ b/src/pmproxy/pmproxy.service.in @@ -6,11 +6,27 @@ BindsTo=pmproxy_check.timer pmproxy_daily.timer [Service] Type=notify -NotifyAccess=all +NotifyAccess=main Restart=always ExecStart=@PCP_SERVICES_DIR@/pmproxy start-systemd Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private [Install] WantedBy=multi-user.target diff --git a/src/pmproxy/pmproxy_check.service.in b/src/pmproxy/pmproxy_check.service.in index 10aa4c226de..06465e81ae0 100644 --- a/src/pmproxy/pmproxy_check.service.in +++ b/src/pmproxy/pmproxy_check.service.in @@ -11,3 +11,19 @@ ExecStart=@PCP_BINADM_DIR@/pmlogger_daily --noerror -Q -K $PMLOGGER_DAILY_PARAMS WorkingDirectory=@PCP_VAR_DIR@ Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +PrivateTmp=yes +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private diff --git a/src/pmproxy/pmproxy_daily.service.in b/src/pmproxy/pmproxy_daily.service.in index 44fac353236..db71594c9b8 100644 --- a/src/pmproxy/pmproxy_daily.service.in +++ b/src/pmproxy/pmproxy_daily.service.in @@ -11,3 +11,19 @@ ExecStart=@PCP_BINADM_DIR@/pmlogger_daily --noerror -Q $PMLOGGER_DAILY_PARAMS WorkingDirectory=@PCP_VAR_DIR@ Group=@PCP_GROUP@ User=@PCP_USER@ +# Hardening: no SystemCallFilter (performance impact). +PrivateTmp=yes +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private diff --git a/src/pmseries/pmseries_import.service.in b/src/pmseries/pmseries_import.service.in index 7b2518a6b43..27585e2980e 100644 --- a/src/pmseries/pmseries_import.service.in +++ b/src/pmseries/pmseries_import.service.in @@ -10,6 +10,23 @@ StandardOutput=journal+console Environment=PYTHONUNBUFFERED=1 ExecStart=@PCP_BINADM_DIR@/pmseries_import SyslogIdentifier=pmseries +# Hardening: no SystemCallFilter (performance impact). +# UMask omitted so service-created files stay world-accessible (PMDAs, QA). +PrivateTmp=yes +ProtectHome=yes +NoNewPrivileges=yes +ProtectClock=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +RestrictNamespaces=yes +SystemCallArchitectures=native +KeyringMode=private [Install] WantedBy=multi-user.target