Opened 3 years ago

Last modified 3 weeks ago

#19759 new enhancement

systemd tor.service hardening: add MemoryDenyWriteExecute=true

Reported by: candrews Owned by:
Priority: Medium Milestone: Tor: unspecified
Component: Core Tor/Tor Version:
Severity: Normal Keywords: tor-relay hardening packaging systemd
Cc: candrews Actual Points:
Parent ID: #30797 Points:
Reviewer: Sponsor:

Description

In systemd 231, the MemoryDenyWriteExecute option was added:

A new service setting MemoryDenyWriteExecute= has been added, taking
a boolean value. If turned on, a service may no longer create memory
mappings that are writable and executable at the same time. This
enhances security for services where this is enabled as it becomes
harder to dynamically write and then execute memory in exploited
service processes. This option has been enabled for all of systemd's
own long-running services.

https://lists.freedesktop.org/archives/systemd-devel/2016-July/037220.html

Can you please add:

MemoryDenyWriteExecute=true

to https://gitweb.torproject.org/tor.git/tree/contrib/dist/tor.service.in in the [Service] section?

Note that systemd < 231 will simply ignore this unknown option so there is no backwards compatibility concern.

Child Tickets

Change History (8)

comment:1 Changed 3 years ago by nickm

Milestone: Tor: 0.2.9.x-final

comment:2 Changed 3 years ago by isabela

Keywords: isaremoved added
Milestone: Tor: 0.2.9.x-finalTor: 0.2.???

comment:3 Changed 3 years ago by teor

Milestone: Tor: 0.2.???Tor: 0.3.???

Milestone renamed

comment:4 Changed 3 years ago by nickm

Keywords: tor-03-unspecified-201612 added
Milestone: Tor: 0.3.???Tor: unspecified

Finally admitting that 0.3.??? was a euphemism for Tor: unspecified all along.

comment:5 Changed 2 years ago by nickm

Keywords: tor-03-unspecified-201612 removed

Remove an old triaging keyword.

comment:6 Changed 2 years ago by nickm

Keywords: isaremoved removed

comment:7 Changed 2 years ago by nickm

Keywords: tor-relay hardening packaging added

comment:8 Changed 3 weeks ago by arma

Parent ID: #30797
Note: See TracTickets for help on using tickets.