systemd: Add systemd sandboxing to services.

This change makes it so the mon/osd/mds/radosgw daemons:
    o Cannot write to /usr, /etc, and /boot.
    o Cannot access /home, /root, or /run/user.
    o Each daemon gets its own private /tmp and /var/tmp.
    o All daemons get a private /dev without physical devices (exception: osd)

I'm not sure if the osd daemon needs access to a full /dev so I left
ProtectDevices out for ceph-osd@.service.

Signed-off-by: Patrick Donnelly <batrick@batbytes.com>

diff --git a/systemd/ceph-mds@.service b/systemd/ceph-mds@.service
index 708f42c815420eac87721a4036460826d84ea7ce..e12258058c74bbf6ec6b6d976a0b004e19aa907d 100644 (file)
--- a/systemd/ceph-mds@.service
+++ b/systemd/ceph-mds@.service
@@ -11,6 +11,10 @@ EnvironmentFile=-/etc/sysconfig/ceph
 Environment=CLUSTER=ceph
 ExecStart=/usr/bin/ceph-mds -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
 ExecReload=/bin/kill -HUP $MAINPID
+PrivateDevices=yes
+ProtectHome=true
+ProtectSystem=full
+PrivateTmp=true
 
 [Install]
 WantedBy=ceph-mds.target

diff --git a/systemd/ceph-mon@.service b/systemd/ceph-mon@.service
index 03a9b6c19e33999bbb81c6c865422bdfb0b80925..a8d427b5ab5ee862a9f23407810c608aacb538f9 100644 (file)
--- a/systemd/ceph-mon@.service
+++ b/systemd/ceph-mon@.service
@@ -17,6 +17,10 @@ EnvironmentFile=-/etc/sysconfig/ceph
 Environment=CLUSTER=ceph
 ExecStart=/usr/bin/ceph-mon -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
 ExecReload=/bin/kill -HUP $MAINPID
+PrivateDevices=yes
+ProtectHome=true
+ProtectSystem=full
+PrivateTmp=true
 
 [Install]
 WantedBy=ceph-mon.target

diff --git a/systemd/ceph-osd@.service b/systemd/ceph-osd@.service
index 82dabdfe38df130450e9ad45ecb90d65e07a802a..1e120c46f1ba62c1d368b7b7fde3db58956cd842 100644 (file)
--- a/systemd/ceph-osd@.service
+++ b/systemd/ceph-osd@.service
@@ -12,6 +12,9 @@ Environment=CLUSTER=ceph
 ExecStart=/usr/bin/ceph-osd -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
 ExecStartPre=/usr/libexec/ceph/ceph-osd-prestart.sh --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
 ExecReload=/bin/kill -HUP $MAINPID
+ProtectHome=true
+ProtectSystem=full
+PrivateTmp=true
 
 [Install]
 WantedBy=ceph-osd.target

diff --git a/systemd/ceph-radosgw@.service b/systemd/ceph-radosgw@.service
index fb09e190d61f42b1a0b57ee3a58d230579b560e2..66d9eb85a2d96413d6aa5dc649caefddb7507b51 100644 (file)
--- a/systemd/ceph-radosgw@.service
+++ b/systemd/ceph-radosgw@.service
@@ -10,6 +10,10 @@ LimitNPROC=1048576
 EnvironmentFile=-/etc/sysconfig/ceph
 Environment=CLUSTER=ceph
 ExecStart=/usr/bin/radosgw -f --cluster ${CLUSTER} --name client.%i --setuser ceph --setgroup ceph
+PrivateDevices=yes
+ProtectHome=true
+ProtectSystem=full
+PrivateTmp=true
 
 [Install]
 WantedBy=ceph-radosgw.target