From ded87cfe36117c8b834b0f36a06caa3f0f8352ba Mon Sep 17 00:00:00 2001
From: zsien <quezhiyong@deepin.org>
Date: Mon, 24 Jun 2024 14:38:02 +0800
Subject: [PATCH] chore: systemd hardening
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

加固 dbus 进程
---
 .../org.deepin.dde.SoundThemePlayer1.service  |  1 +
 .../system/deepin-sound-theme-player.service  | 40 +++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 misc/systemd/system/deepin-sound-theme-player.service

diff --git a/misc/system-services/org.deepin.dde.SoundThemePlayer1.service b/misc/system-services/org.deepin.dde.SoundThemePlayer1.service
index 76006e0..2dc2943 100644
--- a/misc/system-services/org.deepin.dde.SoundThemePlayer1.service
+++ b/misc/system-services/org.deepin.dde.SoundThemePlayer1.service
@@ -2,3 +2,4 @@
 Name=org.deepin.dde.SoundThemePlayer1
 Exec=/usr/lib/deepin-api/sound-theme-player
 User=deepin-sound-player
+SystemdService=dbus-org.deepin.dde.SoundThemePlayer1.service
diff --git a/misc/systemd/system/deepin-sound-theme-player.service b/misc/systemd/system/deepin-sound-theme-player.service
new file mode 100644
index 0000000..46beaf6
--- /dev/null
+++ b/misc/systemd/system/deepin-sound-theme-player.service
@@ -0,0 +1,40 @@
+[Unit]
+Description=Deepin Sound Theme Player
+
+Requisite=sound.target
+After=sound.target
+
+# Ask for the dbus socket.
+Wants=dbus.socket
+After=dbus.socket
+
+[Service]
+Type=dbus
+BusName=org.deepin.dde.SoundThemePlayer1
+User=deepin-sound-player
+ExecStart=/usr/lib/deepin-api/sound-theme-player
+
+DevicePolicy=closed
+DeviceAllow=char-alsa rw
+
+ProtectSystem=full
+ProtectHome=true
+ReadWritePaths=/var/lib/deepin-sound-player
+PrivateTmp=true
+#PrivateDevices=true
+PrivateNetwork=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+RemoveIPC=true
+
+[Install]
+Alias=dbus-org.deepin.dde.SoundThemePlayer1.service