iptables backend is currently broken for unknown reasons.
`nftables` backend works for iptables firewall too,
if built with nftablesCompat = true (our default).
The unit's UMask=0027 was masking spire-agent's own
os.MkdirAll("/run/spire/agent/public", 0755) down to mode 0750, so any
process not in the spire-agent group got EACCES on connect() — defeating
the point of workload attestation, which is supposed to identify
arbitrary callers regardless of their unix identity.
Pre-create the directory via RuntimeDirectory so systemd applies
RuntimeDirectoryMode (0755) independent of umask; spire-agent's MkdirAll
then becomes a no-op.
Also exercises the path in the NixOS test by fetching an SVID as a
normal user.
When OpenBao is placed behind a reverse proxy like nginx, it's
preferable to have OpenBao listen on a Unix Socket instead of TCP/IP.
OpenBao supports this, we just need to relax our sandboxing for this
ever so slightly.
The default effective socket_mode is left untouched. Meaning even with
RuntimeDirectoryMode=0755, other services can't just access OpenBao's
Unix Socket because of its Umask=0077. One needs to explicitly configure
socket_mode, socket_user and socket_group in OpenBao's [unix listener
config] to make use of this.
Additionally, setting User=openbao and Group=openbao allows other
services to make use of SupplementaryGroups=openbao or OpenBao to use
e.g. Postgres peer authentication.
[unix listener config]: https://openbao.org/docs/configuration/listener/unix/
Co-authored-by emilylange <git@emilylange.de>
Adding an example provides necessary guideline for how the format should be (i.e. without leading https://, else the domain is added as a base path, e.g. /vaultwarden.example.com). The example was chosen to match the example config (bitwarden.example.com).
This has caused problems before, and again recently https://github.com/kanidm/kanidm/issues/4209.
Instead of continuing to fix edge cases from this non-standard hardening, remove it.
On our prod machines, aesmd would always fail the first time after boot,
with logs like:
`XXX-copy-aesmd-data-files.sh[770]: chown: invalid user: 'aesmd:aesmd'`.
Everything would be fine after the next restart, but blocking boot for
15 seconds is definitely annoying.
It appears the issue was that we were trying to name the DynamicUser
User and Group (aesmd/aesmd) during ExecStartPre, but systemd only
creates these right before ExecStart. After playing around with the
ExecStartPre script, I finally got it to work correctly. As a bonus, we
can also re-add the RootDirectory/chroot hardening.
I've also cleaned out the config for the old out-of-tree isgx driver and
the old DCAP driver. The kernel has had in-kernel SGX support since 5.11
(~2021/02).
