net-misc/radvd: systemd hardening

Improve the systemd unit by having radvd never run as root, restricting capabilities as much as possible, and limiting file system access.

Gentoo-bug: 587588

diff --git a/net-misc/radvd/files/radvd.service b/net-misc/radvd/files/radvd.service
index d9095f625a9c64f678e0d8abae8c743f7de6c77b..a3ac66f84963eb099de8e9f0e57c5fa7501b27f5 100644 (file)
--- a/net-misc/radvd/files/radvd.service
+++ b/net-misc/radvd/files/radvd.service
@@ -4,12 +4,23 @@ Documentation=man:radvd(8)
 After=network.target
 
 [Service]
+User=radvd
+Group=radvd
 Type=forking
-ExecStart=/usr/sbin/radvd --username radvd --logmethod stderr --debug 0
+ExecStartPre=/usr/sbin/radvd --configtest
+ExecStart=/usr/sbin/radvd --logmethod stderr --debug 0
 ExecReload=/usr/sbin/radvd --configtest ; \
            /bin/kill -HUP $MAINPID
 CPUSchedulingPolicy=idle
 PIDFile=/run/radvd/radvd.pid
+RuntimeDirectory=radvd
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE  CAP_NET_RAW
+AmbientCapabilities=CAP_NET_BIND_SERVICE  CAP_NET_RAW
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=full
+ProtectHome=yes
+NoNewPrivileges=yes
 
 [Install]
 WantedBy=multi-user.target