diff options
| author | Christian Poessinger <christian@poessinger.com> | 2021-09-08 14:35:20 +0200 |
|---|---|---|
| committer | Kim Hagen <kim@sentrium.io> | 2021-10-07 09:49:47 -0500 |
| commit | 699d4533c543f2578c68f1d3ca9f2a2b8d5c4692 (patch) | |
| tree | da8bd9ba11955915312a340d7dbd5e2790c07f1b | |
| parent | 2349f2d91213b702394e9ca72aa2e6d4ee8c0dae (diff) | |
| download | vyos-1x-699d4533c543f2578c68f1d3ca9f2a2b8d5c4692.tar.gz vyos-1x-699d4533c543f2578c68f1d3ca9f2a2b8d5c4692.zip | |
openvpn: T3805: drop privileges using systemd - required for rtnetlink
| -rw-r--r-- | data/templates/openvpn/server.conf.tmpl | 2 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces-openvpn.py | 2 | ||||
| -rw-r--r-- | src/etc/systemd/system/openvpn@.service.d/override.conf | 4 |
3 files changed, 4 insertions, 4 deletions
diff --git a/data/templates/openvpn/server.conf.tmpl b/data/templates/openvpn/server.conf.tmpl index 3104203ad..5c78d998e 100644 --- a/data/templates/openvpn/server.conf.tmpl +++ b/data/templates/openvpn/server.conf.tmpl @@ -7,8 +7,6 @@ # verb 3 -user {{ daemon_user }} -group {{ daemon_group }} dev-type {{ device_type }} dev {{ ifname }} persist-key diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py index 94fb14246..d57ccb354 100755 --- a/src/conf_mode/interfaces-openvpn.py +++ b/src/conf_mode/interfaces-openvpn.py @@ -92,8 +92,6 @@ def get_config(config=None): openvpn['pki'] = tmp_pki openvpn['auth_user_pass_file'] = '/run/openvpn/{ifname}.pw'.format(**openvpn) - openvpn['daemon_user'] = user - openvpn['daemon_group'] = group # We have to cleanup the config dict, as default values could enable features # which are not explicitly enabled on the CLI. Example: server mfa totp diff --git a/src/etc/systemd/system/openvpn@.service.d/override.conf b/src/etc/systemd/system/openvpn@.service.d/override.conf index 7946484a3..03fe6b587 100644 --- a/src/etc/systemd/system/openvpn@.service.d/override.conf +++ b/src/etc/systemd/system/openvpn@.service.d/override.conf @@ -7,3 +7,7 @@ WorkingDirectory= WorkingDirectory=/run/openvpn ExecStart= ExecStart=/usr/sbin/openvpn --daemon openvpn-%i --config %i.conf --status %i.status 30 --writepid %i.pid +User=openvpn +Group=openvpn +AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE |