Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: systemd hardening #51

Merged
merged 1 commit into from
Sep 4, 2024
Merged

chore: systemd hardening #51

merged 1 commit into from
Sep 4, 2024

Conversation

zsien
Copy link
Contributor

@zsien zsien commented Sep 3, 2024

@zsien zsien requested a review from a team September 3, 2024 06:57
@deepin-ci-robot
Copy link

deepin pr auto review

关键摘要:

  • 服务文件中新增的DevicePolicy=closed配置可能不适用于所有场景，需要确认是否对系统安全有足够的支持。
  • 使用了/usr/lib/dde-api-proxy/dbus-proxy/dde-api-dbus-proxy-system-v1命令，但未检查该命令是否存在且路径是否正确。
  • 配置了多种保护选项，但未提供解释或说明这些选项的用途，可能需要更详细的文档说明。
  • 新增的RestrictAddressFamilies=AF_UNIX和RestrictNamespaces=yes配置可能限制了进程的运行环境，需要确保这些更改不会对现有功能产生负面影响。

是否建议立即修改:

  • 是，特别是对于路径错误和配置的解释说明，这些需要立即解决以避免潜在的运行时问题。
  • 是，如果DevicePolicy=closed不符合项目的系统安全策略，需要立即进行调整。
  • 是，如果新增的保护选项没有经过充分评估，建议暂时不使用这些配置或提供更多上下文信息。

@deepin-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fly602, zsien

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@zsien zsien merged commit 82ab2f2 into linuxdeepin:master Sep 4, 2024
16 checks passed
@zsien zsien deleted the zs/systemdhardening branch September 4, 2024 05:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fly602 fly602 fly602 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@zsien @deepin-ci-robot @fly602