scx_loader: Lockdown systemd service

[frap129]

This is an attempt to perform the systemd hardening suggested by #12 . The following options were determined by profiling the service with shh (systemd hardening helper). It was done by starting profiling with shh, running through every scxctl option (stop, start sched with modes/args, switch with modes/args, restart, get, list), then ending profiling. AFAICT everything works fine w/ the new hardening options, but I would appreciate testing to make sure it works on more than just my system.

[sirlucjan]

SocketBindDeny=ipv4:tcp
SocketBindDeny=ipv4:udp
SocketBindDeny=ipv6:tcp
SocketBindDeny=ipv6:udp

I'm not sure about above, but LGTM overall.

[frap129]

SocketBindDeny=ipv4:tcp
SocketBindDeny=ipv4:udp
SocketBindDeny=ipv6:tcp
SocketBindDeny=ipv6:udp

I'm not sure about above, but LGTM overall.

Probably not needed since we don't do any networking, but would protect against the binary getting replaced with a malicious one that adds networking, or if any crate we depend on goes rogue or has a malicious upload.

Honestly I think most of these options are overkill, but preemptively restricting perms and capabilities as much as possible will reduce the chances of new security issues springing up in future.

[vnepogodin]

Breaks only rustland

Dec 04 18:12:40 cachyos scx_loader[2715]: [INFO]: starting scx_rustland command
Dec 04 18:12:40 cachyos scx_loader[70589]: thread 'main' (70589) panicked at rust/scx_rustland_core/src/alloc.rs:495:17:
Dec 04 18:12:40 cachyos scx_loader[70589]: mlockall failed with error code: -1
Dec 04 18:12:40 cachyos scx_loader[70589]: note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Dec 04 18:12:40 cachyos scx_loader[2715]: [ERROR]: Failed to start scheduler (attempt 5/5)

[vnepogodin]

worked with that diff (generated using shh)

@@ -7,11 +7,8 @@
 ExecStart=/usr/bin/scx_loader
 KillSignal=SIGINT
 ProtectSystem=full
-ProtectHome=true
 PrivateTmp=disconnected
-PrivateDevices=true
 PrivateMounts=true
-ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectKernelLogs=true
 ProtectControlGroups=true
@@ -24,8 +21,8 @@
 SocketBindDeny=ipv4:udp
 SocketBindDeny=ipv6:tcp
 SocketBindDeny=ipv6:udp
-CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_CHOWN CAP_IPC_LOCK CAP_MKNOD CAP_NET_RAW CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYSLOG CAP_WAKE_ALARM
-SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @raw-io:EPERM @reboot:EPERM @sandbox:EPERM @setuid:EPERM @swap:EPERM @sync:EPERM @timer:EPERM
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYSLOG CAP_WAKE_ALARM
+SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @keyring:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @raw-io:EPERM @reboot:EPERM @setuid:EPERM @swap:EPERM @sync:EPERM @timer:EPERM

 [Install]
 WantedBy=graphical.target

[vnepogodin]

^