1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
From: Bastian Germann <bage@debian.org>
Date: Mar, 01 2026 16:19:13 +0100
Bug-Debian: https://bugs.debian.org/1116595
Subject: reduce security lockdowns to avoid postfix problems
Apply upstream 50411335572120153cc84d54213cd5ca9dd11b14 to the other
systemd services that people might have problems with.
---
--- xfsprogs-6.18.0.orig/scrub/xfs_scrub_all.service.in
+++ xfsprogs-6.18.0/scrub/xfs_scrub_all.service.in
@@ -25,61 +25,3 @@ IOSchedulingClass=idle
CPUSchedulingPolicy=idle
CPUAccounting=true
Nice=19
-
-# No realtime scheduling
-RestrictRealtime=true
-
-# No special privileges, but we still have to run as root so that we can
-# contact the service manager to start the sub-units.
-CapabilityBoundingSet=
-NoNewPrivileges=true
-RestrictSUIDSGID=true
-
-# Make the entire filesystem readonly except for the media scan stamp file
-# directory. We don't want to hide anything because we need to find all
-# mounted XFS filesystems in the host.
-ProtectSystem=strict
-ProtectHome=read-only
-PrivateTmp=false
-BindPaths=@pkg_state_dir@
-
-# No network access except to the systemd control socket
-PrivateNetwork=true
-ProtectHostname=true
-RestrictAddressFamilies=AF_UNIX
-IPAddressDeny=any
-
-# Don't let the program mess with the kernel configuration at all
-ProtectKernelLogs=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectControlGroups=true
-ProtectProc=invisible
-RestrictNamespaces=true
-
-# Hide everything in /proc, even /proc/mounts
-ProcSubset=pid
-
-# Only allow the default personality Linux
-LockPersonality=true
-
-# No writable memory pages
-MemoryDenyWriteExecute=true
-
-# Don't let our mounts leak out to the host
-PrivateMounts=true
-
-# Restrict system calls to the native arch and only enough to get things going
-SystemCallArchitectures=native
-SystemCallFilter=@system-service
-SystemCallFilter=~@privileged
-SystemCallFilter=~@resources
-SystemCallFilter=~@mount
-
-# Media scan stamp file shouldn't be readable by regular users
-UMask=0077
-
-# lsblk ignores mountpoints if it can't find the device files, so we cannot
-# hide them
-#ProtectClock=true
-#PrivateDevices=true
--- xfsprogs-6.18.0.orig/scrub/xfs_scrub_all_fail.service.in
+++ xfsprogs-6.18.0/scrub/xfs_scrub_all_fail.service.in
@@ -14,58 +14,3 @@ ExecStart=@pkg_libexec_dir@/xfs_scrub_fa
User=mail
Group=mail
SupplementaryGroups=systemd-journal
-
-# No realtime scheduling
-RestrictRealtime=true
-
-# Make the entire filesystem readonly and /home inaccessible.
-ProtectSystem=full
-ProtectHome=yes
-PrivateTmp=true
-RestrictSUIDSGID=true
-
-# Emailing reports requires network access, but not the ability to change the
-# hostname.
-ProtectHostname=true
-
-# Don't let the program mess with the kernel configuration at all
-ProtectKernelLogs=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectControlGroups=true
-ProtectProc=invisible
-RestrictNamespaces=true
-
-# Can't hide /proc because journalctl needs it to find various pieces of log
-# information
-#ProcSubset=pid
-
-# Only allow the default personality Linux
-LockPersonality=true
-
-# No writable memory pages
-MemoryDenyWriteExecute=true
-
-# Don't let our mounts leak out to the host
-PrivateMounts=true
-
-# Restrict system calls to the native arch and only enough to get things going
-SystemCallArchitectures=native
-SystemCallFilter=@system-service
-SystemCallFilter=~@privileged
-SystemCallFilter=~@resources
-SystemCallFilter=~@mount
-
-# xfs_scrub needs these privileges to run, and no others
-CapabilityBoundingSet=
-NoNewPrivileges=true
-
-# Failure reporting shouldn't create world-readable files
-UMask=0077
-
-# Clean up any IPC objects when this unit stops
-RemoveIPC=true
-
-# No access to hardware device files
-PrivateDevices=true
-ProtectClock=true
|
