|
| Description: |
The units that run XWiki ({{tomcatN.service}}, {{xwiki.service}}) only use a few systemd sandboxing options. A script or a vulnerable extension running inside XWiki can therefore read most of the system, open any socket and run any program.
Let xinit write a hardening drop-in for the servlet unit at a chosen level, and test each level per installation type: its {{systemd-analyze security}} score, a functional suite (XWiki still works) and an attack suite (what code running inside XWiki can no longer do). The strictest level only allows running the JVM, which needs XWiki to be started with {{java}} directly rather than through the packages' shell scripts.
Analysis and plan: [https://github.com/ciaens/xinit/blob/claude/sleepy-pasteur-57a86v/docs/phases/phase-5-security.md]. |
| Assignee: |
Clément Christiaens |
|
