Debian Bug report logs - #1009964
php-fpm.service should be hardened

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Andrea Pappacoda <andrea@pappacoda.it>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: php-fpm.service should be hardened

Date: Thu, 21 Apr 2022 13:23:57 +0200

[Message part 1 (text/plain, inline)]

Package: php-fpm
Version: 2:7.4+76
Severity: normal
Tags: patch

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi, I think that the php-fpm systemd service should be hardened. php's security
is particularly important, as it is a widely used, long-running service with a
lot of responsibilities and privileges.

Upstream has been shipping an hardened systemd service for a few years[1][2],
and I really think that Debian should do the same, if not better.

I've been running php with a really strict set of hardenings for a while, but
some of them are really tailored to my specific setup and can't be applied by
default. I'm leaving an attached patch with some hardenings that I believe are
safe to deploy for everyone. My setup is fairly limited though, and further
testing is required.

With the supplied configuration, `systemd-analyze security php7.4-fpm` reports
an overall exposure level of 2.3, and that's extremely good if compared to the
9.6 score of the current unit :D

Thanks for your work on the php packages!

1: https://bugs.php.net/72510

2: https://github.com/php/php-
src/commit/40c4d7f1820df1872a71ab07fd26da45a203e37f


- -- System Information:
Debian Release: bookworm/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.16.0-6-amd64 (SMP w/4 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=it_IT.UTF-8, LC_CTYPE=it_IT.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages php-fpm depends on:
pn  php8.1-fpm  <none>

php-fpm recommends no packages.

php-fpm suggests no packages.

-----BEGIN PGP SIGNATURE-----

iIoEARYIADIWIQRm3vFSgpkMIZnvqAGooSioqxzuSQUCYmE+zBQcYW5kcmVhQHBh
cHBhY29kYS5pdAAKCRCooSioqxzuScv0AQCi+nRjV57XdEX4adIrWGrcNDFGukWT
sTsO/DEN1RFiLwEA2XMbOKPnr1bcdFFy1n01ePk4TjK2DO5mt6TpVpBDjA0=
=3j1J
-----END PGP SIGNATURE-----

[0001-d-php-fpm.service-harden.patch (text/plain, attachment)]

Message #10 received at 1009964@bugs.debian.org (full text, mbox, reply):

From: Andrea Pappacoda <andrea@pappacoda.it>

To: 1009964@bugs.debian.org

Subject: php-fpm.service should be hardened - updated patch

Date: Thu, 21 Apr 2022 15:39:36 +0200

[Message part 1 (text/plain, inline)]

Attaching an updated patch, since the one I attached in the first 
message has `PrivateNetwork=true` in it, an that obviously breaks PHP

[0001-d-php-fpm.service-harden.patch (text/x-patch, attachment)]

Send a report that this bug log contains spam.