Merge pull request #6985 from joshuaboniface/unharden-for-lxc

debian/conf/jellyfin

@@ -44,6 +44,8 @@ JELLYFIN_ADDITIONAL_OPTS=""
 #
 # SysV init/Upstart options
 #
+# Note: These options are ignored by systemd; use /etc/systemd/system/jellyfin.d overrides instead.
+#
 
 # Application username
 JELLYFIN_USER="jellyfin"

debian/jellyfin.service

@@ -6,23 +6,26 @@ After = network-online.target
 Type = simple
 EnvironmentFile = /etc/default/jellyfin
 User = jellyfin
+Group = jellyfin
+WorkingDirectory = /var/lib/jellyfin
 ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS}
 Restart = on-failure
 TimeoutSec = 15
+SuccessExitStatus=0 143
 
 NoNewPrivileges=true
 SystemCallArchitectures=native
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-RestrictNamespaces=true
+RestrictNamespaces=false
 RestrictRealtime=true
 RestrictSUIDSGID=true
-ProtectControlGroups=true
+ProtectControlGroups=false
 ProtectHostname=true
-ProtectKernelLogs=true
+ProtectKernelLogs=false
-ProtectKernelModules=true
+ProtectKernelModules=false
-ProtectKernelTunables=true
+ProtectKernelTunables=false
 LockPersonality=true
-PrivateTmp=true
+PrivateTmp=false
 PrivateDevices=false
 PrivateUsers=true
 RemoveIPC=true
@@ -43,6 +46,5 @@ SystemCallFilter=~@setuid
 SystemCallFilter=~@swap
 SystemCallErrorNumber=EPERM
 
-
 [Install]
 WantedBy = multi-user.target

fedora/jellyfin.service

@@ -1,15 +1,51 @@
 [Unit]
-After=network-online.target
+Description = Jellyfin Media Server
-Description=Jellyfin is a free software media system that puts you in control of managing and streaming your media.
+After = network-online.target
 
 [Service]
-EnvironmentFile=/etc/sysconfig/jellyfin
+Type = simple
-WorkingDirectory=/var/lib/jellyfin
+EnvironmentFile = /etc/sysconfig/jellyfin
-ExecStart=/usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT}
+User = jellyfin
-TimeoutSec=15
+Group = jellyfin
-Restart=on-failure
+WorkingDirectory = /var/lib/jellyfin
-User=jellyfin
+ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS}
-Group=jellyfin
+Restart = on-failure
+TimeoutSec = 15
+SuccessExitStatus=0 143
+
+NoNewPrivileges=true
+SystemCallArchitectures=native
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=false
+RestrictRealtime=true
+RestrictSUIDSGID=true
+ProtectClock=true
+ProtectControlGroups=false
+ProtectHostname=true
+ProtectKernelLogs=false
+ProtectKernelModules=false
+ProtectKernelTunables=false
+LockPersonality=true
+PrivateTmp=false
+PrivateDevices=false
+PrivateUsers=true
+RemoveIPC=true
+SystemCallFilter=~@clock
+SystemCallFilter=~@aio
+SystemCallFilter=~@chown
+SystemCallFilter=~@cpu-emulation
+SystemCallFilter=~@debug
+SystemCallFilter=~@keyring
+SystemCallFilter=~@memlock
+SystemCallFilter=~@module
+SystemCallFilter=~@mount
+SystemCallFilter=~@obsolete
+SystemCallFilter=~@privileged
+SystemCallFilter=~@raw-io
+SystemCallFilter=~@reboot
+SystemCallFilter=~@setuid
+SystemCallFilter=~@swap
+SystemCallErrorNumber=EPERM
 
 [Install]
-WantedBy=multi-user.target
+WantedBy = multi-user.target