Skip to content

Commit e7ac072

Browse files
RajatGupta02Rajat Gupta
RajatGupta02
and
Rajat Gupta
authored
Add systemd configurations to strengthen OS core security (opensearch-project#17107)
* Add systemd configurations to strengthen OS core security Signed-off-by: Rajat Gupta <gptrajat@amazon.com> * Add systemd template unit file Signed-off-by: Rajat Gupta <gptrajat@amazon.com> * Update CHANGELOG-3.0.md Signed-off-by: Rajat Gupta <gptrajat@amazon.com> * Revert "Add systemd configurations to strengthen OS core security" This reverts commit 71b2584. Signed-off-by: Rajat Gupta <gptrajat@amazon.com> * Remove SocketBind Directives and template unit file Signed-off-by: Rajat Gupta <gptrajat@amazon.com> * Minor fixes Signed-off-by: Rajat Gupta <gptrajat@amazon.com> * Modify systemd unit file in core to be in sync with distribution unit file Signed-off-by: Rajat Gupta <gptrajat@amazon.com> * Modify systemd env file to be in sync with opensearch-build Signed-off-by: Rajat Gupta <gptrajat@amazon.com> --------- Signed-off-by: Rajat Gupta <gptrajat@amazon.com> Signed-off-by: Rajat Gupta <72070007+RajatGupta02@users.noreply.github.com> Co-authored-by: Rajat Gupta <gptrajat@amazon.com>
1 parent 4bd1323 commit e7ac072

File tree

3 files changed

+114
-13
lines changed

3 files changed

+114
-13
lines changed

‎CHANGELOG-3.0.md

+1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
1414
- [WLM] Add WLM support for search scroll API ([#16981](https://github.com/opensearch-project/OpenSearch/pull/16981))
1515
- Allow to pass the list settings through environment variables (like [], ["a", "b", "c"], ...) ([#10625](https://github.com/opensearch-project/OpenSearch/pull/10625))
1616
- Views, simplify data access and manipulation by providing a virtual layer over one or more indices ([#11957](https://github.com/opensearch-project/OpenSearch/pull/11957))
17+
- Add systemd configurations to strengthen OS core security ([#17107](https://github.com/opensearch-project/OpenSearch/pull/17107))
1718
- Added pull-based Ingestion (APIs, for ingestion source, a Kafka plugin, and IngestionEngine that pulls data from the ingestion source) ([#16958](https://github.com/opensearch-project/OpenSearch/pull/16958))
1819
- Added ConfigurationUtils to core for the ease of configuration parsing [#17223](https://github.com/opensearch-project/OpenSearch/pull/17223)
1920
- Add execution_hint to cardinality aggregator request (#[17312](https://github.com/opensearch-project/OpenSearch/pull/17312))

‎distribution/packages/src/common/env/opensearch

+8-7
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,17 @@
33
################################
44

55
# OpenSearch home directory
6-
#OPENSEARCH_HOME=/usr/share/opensearch
6+
OPENSEARCH_HOME=/usr/share/opensearch
77

88
# OpenSearch Java path
9-
#OPENSEARCH_JAVA_HOME=
9+
#OPENSEARCH_JAVA_HOME=/usr/lib/jvm/java-11-amazon-corretto
1010

1111
# OpenSearch configuration directory
1212
# Note: this setting will be shared with command-line tools
13-
OPENSEARCH_PATH_CONF=${path.conf}
13+
OPENSEARCH_PATH_CONF=/etc/opensearch
1414

1515
# OpenSearch PID directory
16-
#PID_DIR=/var/run/opensearch
16+
PID_DIR=/var/run/opensearch
1717

1818
# Additional Java OPTS
1919
#OPENSEARCH_JAVA_OPTS=
@@ -25,11 +25,12 @@ OPENSEARCH_PATH_CONF=${path.conf}
2525
# OpenSearch service
2626
################################
2727

28-
# SysV init.d
29-
#
3028
# The number of seconds to wait before checking if OpenSearch started successfully as a daemon process
3129
OPENSEARCH_STARTUP_SLEEP_TIME=5
3230

31+
# Notification for systemd
32+
OPENSEARCH_SD_NOTIFY=true
33+
3334
################################
3435
# System properties
3536
################################
@@ -49,4 +50,4 @@ OPENSEARCH_STARTUP_SLEEP_TIME=5
4950
# Maximum number of VMA (Virtual Memory Areas) a process can own
5051
# When using Systemd, this setting is ignored and the 'vm.max_map_count'
5152
# property is set at boot time in /usr/lib/sysctl.d/opensearch.conf
52-
#MAX_MAP_COUNT=262144
53+
#MAX_MAP_COUNT=262144

‎distribution/packages/src/common/systemd/opensearch.service

+105-6
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,25 @@
1+
# Copyright OpenSearch Contributors
2+
# SPDX-License-Identifier: Apache-2.0
3+
#
4+
# The OpenSearch Contributors require contributions made to
5+
# this file be licensed under the Apache-2.0 license or a
6+
# compatible open source license.
7+
8+
# Description:
9+
# Default opensearch.service file
10+
111
[Unit]
212
Description=OpenSearch
3-
Documentation=https://www.elastic.co
13+
Documentation=https://opensearch.org/
414
Wants=network-online.target
515
After=network-online.target
616

717
[Service]
818
Type=notify
919
RuntimeDirectory=opensearch
1020
PrivateTmp=true
11-
Environment=OPENSEARCH_HOME=/usr/share/opensearch
12-
Environment=OPENSEARCH_PATH_CONF=${path.conf}
13-
Environment=PID_DIR=/var/run/opensearch
14-
Environment=OPENSEARCH_SD_NOTIFY=true
15-
EnvironmentFile=-${path.env}
21+
EnvironmentFile=-/etc/default/opensearch
22+
EnvironmentFile=-/etc/sysconfig/opensearch
1623

1724
WorkingDirectory=/usr/share/opensearch
1825

@@ -29,6 +36,7 @@ ExecStart=/usr/share/opensearch/bin/systemd-entrypoint -p ${PID_DIR}/opensearch.
2936
# logging, you can simply remove the "quiet" option from ExecStart.
3037
StandardOutput=journal
3138
StandardError=inherit
39+
SyslogIdentifier=opensearch
3240

3341
# Specifies the maximum file descriptor number that can be opened by this process
3442
LimitNOFILE=65535
@@ -60,6 +68,97 @@ SuccessExitStatus=143
6068
# Allow a slow startup before the systemd notifier module kicks in to extend the timeout
6169
TimeoutStartSec=75
6270

71+
# Prevent modifications to the control group filesystem
72+
ProtectControlGroups=true
73+
74+
# Prevent loading or reading kernel modules
75+
ProtectKernelModules=true
76+
77+
# Prevent altering kernel tunables (sysctl parameters)
78+
ProtectKernelTunables=true
79+
80+
# Set device access policy to 'closed', allowing access only to specific devices
81+
DevicePolicy=closed
82+
83+
# Make /proc invisible to the service, enhancing isolation
84+
ProtectProc=invisible
85+
86+
# Make /usr, /boot, and /etc read-only (less restrictive than 'strict')
87+
ProtectSystem=full
88+
89+
# Prevent changes to control groups (redundant with earlier setting, can be removed)
90+
ProtectControlGroups=yes
91+
92+
# Prevent changing the execution domain
93+
LockPersonality=yes
94+
95+
96+
# System call filtering
97+
# System call filterings which restricts which system calls a process can make
98+
# @ means allowed
99+
# ~ means not allowed
100+
SystemCallFilter=@system-service
101+
SystemCallFilter=~@reboot
102+
SystemCallFilter=~@swap
103+
104+
SystemCallErrorNumber=EPERM
105+
106+
# Capability restrictions
107+
# Remove the ability to block system suspends
108+
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND
109+
110+
# Remove the ability to establish leases on files
111+
CapabilityBoundingSet=~CAP_LEASE
112+
113+
# Remove the ability to use system resource accounting
114+
CapabilityBoundingSet=~CAP_SYS_PACCT
115+
116+
# Remove the ability to configure TTY devices
117+
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
118+
119+
# Remov below capabilities:
120+
# - CAP_SYS_ADMIN: Various system administration operations
121+
# - CAP_SYS_PTRACE: Ability to trace processes
122+
# - CAP_NET_ADMIN: Various network-related operations
123+
CapabilityBoundingSet=~CAP_SYS_ADMIN ~CAP_SYS_PTRACE ~CAP_NET_ADMIN
124+
125+
126+
# Address family restrictions
127+
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
128+
129+
# Filesystem Access
130+
131+
ReadWritePaths=/var/log/opensearch
132+
ReadWritePaths=/var/lib/opensearch
133+
ReadWritePaths=-/etc/opensearch
134+
ReadWritePaths=-/mnt/snapshots
135+
136+
## Allow read access to system files
137+
ReadOnlyPaths=/etc/os-release /usr/lib/os-release /etc/system-release
138+
139+
## Allow read access to Linux IO stats
140+
ReadOnlyPaths=/proc/self/mountinfo /proc/diskstats
141+
142+
## Allow read access to control group stats
143+
ReadOnlyPaths=/proc/self/cgroup /sys/fs/cgroup/cpu /sys/fs/cgroup/cpu/-
144+
ReadOnlyPaths=/sys/fs/cgroup/cpuacct /sys/fs/cgroup/cpuacct/- /sys/fs/cgroup/memory /sys/fs/cgroup/memory/-
145+
146+
147+
RestrictNamespaces=true
148+
149+
NoNewPrivileges=true
150+
151+
# Memory and execution protection
152+
MemoryDenyWriteExecute=true # Prevent creating writable executable memory mappings
153+
SystemCallArchitectures=native # Allow only native system calls
154+
KeyringMode=private # Service does not share key material with other services
155+
LockPersonality=true # Prevent changing ABI personality
156+
RestrictSUIDSGID=true # Prevent creating SUID/SGID files
157+
RestrictRealtime=true # Prevent acquiring realtime scheduling
158+
ProtectHostname=true # Prevent changes to system hostname
159+
ProtectKernelLogs=true # Prevent reading/writing kernel logs
160+
ProtectClock=true # Prevent tampering with the system clock
161+
63162
[Install]
64163
WantedBy=multi-user.target
65164

0 commit comments

Comments
 (0)