xfs_scrub_media_fail: reduce security lockdowns to avoid postfix problems

The same lockdown logic of commit 9042fcc08eed6a ("xfs_scrub_fail:
tighten up the security on the background systemd service") was applied
to the media scan failure reporting service.  Therefore, it's also
broken on systems that have setgid mailer programs (e.g. postfix).
Fix this by applying the same change from commit 15fd6fc686d5ce here
too.

Cc: linux-xfs@vger.kernel.org # v6.17.0
Fixes: 15fd6fc686d5ce ("xfs_scrub_fail: reduce security lockdowns to avoid postfix problems")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Fixes: 45ec29cfba02 ("xfs_scrub_all: support metadata+media scans of all filesystems")
Reviewed-by: Andrey Albershteyn <aalbersh@kernel.org>

diff --git a/scrub/xfs_scrub_media_fail@.service.in b/scrub/xfs_scrub_media_fail@.service.in
index 97c0e090721d65a2c75b18bbb71e7f26a639afb6..e354dda146f1e3bbc622784658a8c72189a3c7ab 100644 (file)
--- a/scrub/xfs_scrub_media_fail@.service.in
+++ b/scrub/xfs_scrub_media_fail@.service.in
@@ -19,58 +19,6 @@ SupplementaryGroups=systemd-journal
 # can control resource usage.
 Slice=system-xfs_scrub.slice
 
-# No realtime scheduling
-RestrictRealtime=true
-
-# Make the entire filesystem readonly and /home inaccessible, then bind mount
-# the filesystem we're supposed to be checking into our private /tmp dir.
-ProtectSystem=full
-ProtectHome=yes
-PrivateTmp=true
-RestrictSUIDSGID=true
-
-# Emailing reports requires network access, but not the ability to change the
-# hostname.
-ProtectHostname=true
-
-# Don't let the program mess with the kernel configuration at all
-ProtectKernelLogs=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectControlGroups=true
-ProtectProc=invisible
-RestrictNamespaces=true
-
-# Can't hide /proc because journalctl needs it to find various pieces of log
-# information
-#ProcSubset=pid
-
-# Only allow the default personality Linux
-LockPersonality=true
-
-# No writable memory pages
-MemoryDenyWriteExecute=true
-
-# Don't let our mounts leak out to the host
-PrivateMounts=true
-
-# Restrict system calls to the native arch and only enough to get things going
-SystemCallArchitectures=native
-SystemCallFilter=@system-service
-SystemCallFilter=~@privileged
-SystemCallFilter=~@resources
-SystemCallFilter=~@mount
-
-# xfs_scrub needs these privileges to run, and no others
-CapabilityBoundingSet=
-NoNewPrivileges=true
-
-# Failure reporting shouldn't create world-readable files
-UMask=0077
-
-# Clean up any IPC objects when this unit stops
-RemoveIPC=true
-
-# No access to hardware device files
-PrivateDevices=true
-ProtectClock=true
+# No further restrictions because some installations may have MTAs such as
+# postfix, which require the ability to run setgid programs and other
+# foolishness.