chore: systemd hardening

加固 dbus 进程

misc/system-services/org.deepin.dde.LocaleHelper1.service

@@ -2,3 +2,4 @@
 Name=org.deepin.dde.LocaleHelper1
 Exec=/usr/lib/deepin-api/locale-helper
 User=root
+SystemdService=dbus-org.deepin.dde.LocaleHelper1.service

misc/system-services/org.deepin.dde.SoundThemePlayer1.service

@@ -2,3 +2,4 @@
 Name=org.deepin.dde.SoundThemePlayer1
 Exec=/usr/lib/deepin-api/sound-theme-player
 User=deepin-sound-player
+SystemdService=dbus-org.deepin.dde.SoundThemePlayer1.service

misc/systemd/system/deepin-locale-helper.service

@@ -0,0 +1,39 @@
+[Unit]
+Description=Deepin Locale Helper
+
+# Ask for the dbus socket.
+Wants=dbus.socket
+After=dbus.socket
+
+[Service]
+Type=dbus
+BusName=org.deepin.dde.LocaleHelper1
+ExecStart=/usr/lib/deepin-api/locale-helper
+
+ReadWritePaths=/etc/default/locale
+ReadWritePaths=/etc/locale.gen
+ReadWritePaths=/usr/lib/locale/
+ExecPaths=/usr/sbin/locale-gen
+
+DevicePolicy=closed
+
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+PrivateNetwork=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+RemoveIPC=true
+
+[Install]
+Alias=dbus-org.deepin.dde.LocaleHelper1.service

misc/systemd/system/deepin-login-sound.service

@@ -4,22 +4,29 @@ Requires=sound.target
 After=dbus.service lightdm.service
 
 [Service]
-# added automatically, for details please see
-# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+Type=oneshot
+ExecStart=/usr/bin/dbus-send --system --print-reply --dest=org.deepin.dde.SoundThemePlayer1 /org/deepin/dde/SoundThemePlayer1 org.deepin.dde.SoundThemePlayer1.PlaySoundDesktopLogin
+RemainAfterExit=yes
+
+DevicePolicy=closed
+
 ProtectSystem=full
 ProtectHome=true
+PrivateTmp=true
 PrivateDevices=true
+PrivateNetwork=true
 ProtectHostname=true
 ProtectClock=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectKernelLogs=true
 ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=true
+LockPersonality=true
 RestrictRealtime=true
-# end of automatic additions 
-Type=oneshot
-ExecStart=/usr/bin/dbus-send --system --print-reply --dest=org.deepin.dde.SoundThemePlayer1 /org/deepin/dde/SoundThemePlayer1 org.deepin.dde.SoundThemePlayer1.PlaySoundDesktopLogin
-RemainAfterExit=yes
+RestrictSUIDSGID=true
+RemoveIPC=true
 
 [Install]
 WantedBy=multi-user.target

misc/systemd/system/deepin-shutdown-sound.service

@@ -6,24 +6,35 @@ Conflicts=shutdown.target
 Before=shutdown.target
 
 [Service]
-# added automatically, for details please see
-# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+Type=simple
+ExecStart=/usr/bin/true
+ExecStop=/usr/lib/deepin-api/deepin-shutdown-sound
+RemainAfterExit=yes
+TimeoutStopSec=7s
+
+ReadOnlyPaths=/var/lib/deepin-sound-player
+BindReadOnlyPaths=-/tmp/deepin-shutdown-sound.json
+
+DeviceAllow=char-alsa rw
+DevicePolicy=closed
+
 ProtectSystem=full
 ProtectHome=true
+PrivateTmp=true
 #PrivateDevices=true
+PrivateNetwork=true
 ProtectHostname=true
 ProtectClock=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectKernelLogs=true
 ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=true
+LockPersonality=true
 RestrictRealtime=true
-# end of automatic additions 
-Type=simple
-ExecStart=/usr/bin/true
-ExecStop=/usr/lib/deepin-api/deepin-shutdown-sound
-RemainAfterExit=yes
-TimeoutStopSec=7s
+RestrictSUIDSGID=true
+RemoveIPC=true
 
 [Install]
 WantedBy=graphical.target

misc/systemd/system/deepin-sound-theme-player.service

@@ -0,0 +1,41 @@
+[Unit]
+Description=Deepin Sound Theme Player
+
+Requisite=sound.target
+After=sound.target
+
+# Ask for the dbus socket.
+Wants=dbus.socket
+After=dbus.socket
+
+[Service]
+Type=dbus
+BusName=org.deepin.dde.SoundThemePlayer1
+User=deepin-sound-player
+ExecStart=/usr/lib/deepin-api/sound-theme-player
+
+ReadWritePaths=/var/lib/deepin-sound-player
+
+DeviceAllow=char-alsa rw
+DevicePolicy=closed
+
+ProtectSystem=full
+ProtectHome=true
+#PrivateTmp=true
+#PrivateDevices=true
+PrivateNetwork=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+RemoveIPC=true
+
+[Install]
+Alias=dbus-org.deepin.dde.SoundThemePlayer1.service