{"id":111644,"date":"2023-11-21T03:10:16","date_gmt":"2023-11-21T01:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov"},"modified":"2023-11-21T03:10:16","modified_gmt":"2023-11-21T01:10:16","slug":"v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-fedora-40-planiruyut-vklyuchit-izolyacziyu-sistemnyh-servisov","title":{"rendered":"Fedora 40 plans to include isolation for system services.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Fedora 40 release proposes to include isolation settings for systemd services that are enabled by default, as well as for services with important applications such as PostgreSQL, Apache httpd, Nginx, and MariaDB. It is expected that this change will significantly enhance the security of the distribution in its default configuration and allow for the blocking of unknown vulnerabilities in system services. The proposal has not yet been reviewed by the FESCo (Fedora Engineering Steering Committee), which is responsible for the technical development of the Fedora distribution. The proposal may also be rejected during the community review process. <\/p>\n
Recommended settings for inclusion: <\/p>\n
\n
PrivateTmp=yes \u2014 providing separate directories for temporary files.\n
ProtectSystem=yes\/full\/strict \u2014 mounting the filesystem in read-only mode (in 'full' mode \u2014 \/etc\/, in strict mode \u2014 all filesystems except \/dev\/, \/proc\/, and \/sys\/).\n
ProtectHome=yes \u2014 preventing access to users' home directories.\n
PrivateDevices=yes \u2014 allowing access only to \/dev\/null, \/dev\/zero, and \/dev\/random.\n