Adds sandboxing options that bitcoind doesn't need to be exempt from, namely kernel/clock/hostname protection, namespace, realtime and SUID restrictions, a socket address family allowlist, and a system call filter and empty capability bounding set.
Also switches the ExecStartPre chgrp from "!" to "+", since "!" only lifts User=/Group=, and the new syscall filter and capability bounding set would block it otherwise.
<!--e57a25ab6845829454e8d69fc972939a-->
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
<!--006a51241073e994b41acfe9ec718e94-->
<!--021abf342d371248e50ceaed478a90ca-->
See the guideline and AI policy for information on the review process. A summary of reviews will appear here.
24 | @@ -25,7 +25,7 @@ ExecStart=/usr/bin/bitcoind -pid=/run/bitcoind/bitcoind.pid \ 25 | -shutdownnotify='systemd-notify --stopping' 26 | 27 | # Make sure the config directory is readable by the service user 28 | -ExecStartPre=!/bin/chgrp bitcoin /etc/bitcoin 29 | +ExecStartPre=+/bin/chgrp bitcoin /etc/bitcoin
Tested ACK ad2600eb3e44f3a2d164d1f054a922e9f798c18d
I think you hit it, by changing the sandbox restriction and to a symtemd manager privileges, this increase the security of the bitcoind. I ran the security analysis using systemd-analyze security --offline=true contrib/init/bitcoind.service and the result was credible, moving from 7.7 to 1.6 score:
From master
→ Overall exposure level for bitcoind_old.service: 7.7 EXPOSED 🙁
From this PR
→ Overall exposure level for bitcoind.service: 1.6 OK 🙂
<img width="693" height="269" alt="image" src="https://github.com/user-attachments/assets/65e4cab7-68db-4318-8b1e-592fd0e73ebe" />