brltty/brltty — pull request #35 by mlang (2014-11-27 18:04:16+00:00)
Title: Enable some security features in systemd service file.

ProtectHome=read-only eensures that BRLTTY can not write to /home.
ProtectSystem=full ensures that /etc and /usr are read-only.
SystemCallArchitectures=native only leaves syscalls for the native architecture
enabled. So on x86-64, 32bit binary code will likely fail (and vice versa)

All of these are to make it harder for an attacker, should they ever
manage to exploit BRLTTY, to actually tamper with the system.

It is a pitty that CAP_SYS_ADMIN is required for console insertion (which we
really use a lot) but also is a way to manually undo the
protections enabled above. It would be nice if capabilities were
a little bit more fine grained here. But as it stands, I think
enabling these options is a good thing, since it will make it harder to
make use of any potential exploits.

Having a capability for TIOCLINUX would still be very nice.
So we could use CapabilityBoundingSet= as well to limit the capabilities
to those we actually need.