vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-priv: lock personality, deny realtime, kernel logs and module loading

Browse source 
Adds LockPersonality, RestrictRealtime, ProtectKernelLogs and
ProtectKernelModules to the hive-priv unit. Nothing in hive-priv's
sources or its children uses personality(2), real-time scheduling,
/dev/kmsg, /proc/kmsg or explicit module loading.

A module-eval case pins the four directives on the rendered unit.
This commit is contained in:
atlas 2026-10-16 14:11:55 +02:00 • committed by mara
commit b8897e7c7a
3 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/trust-boundary/security.md
View file

@ -322,7 +322,13 @@ above for how the hard-coded unit name scopes its access instead.
**Socket-activated** — systemd starts `hive-priv` on the first
incoming connection (`LISTEN_FDS=1`); it's not running between calls.
The `ProtectSystem=strict` + `ReadWritePaths` sandbox limits filesystem
writes to only the paths `hive-priv` legitimately needs.
writes to only the paths `hive-priv` legitimately needs. The unit also sets
`LockPersonality`, `RestrictRealtime`, `ProtectKernelLogs` and
`ProtectKernelModules`: it changes no execution domain, schedules nothing in
real time, reads no kernel log, and loads no module. It sets none of
`RestrictNamespaces` (`nsenter` into a container needs `setns`),
`RestrictAddressFamilies`, `PrivateDevices`, `CapabilityBoundingSet` or
`SystemCallFilter`; those need a watched deploy to judge.
### Privilege boundary summary