service: apply capabilities for security

Change-Id: If8ea4bba3476acf2d2043f17f6f8b63538fd9f8f
Signed-off-by: Sooyoung Ha <yoosah.ha@samsung.com>

diff --git a/packaging/sdbd_device.service b/packaging/sdbd_device.service
index b47e8f34dfe66be7acd5dfeeb66cbee684c319f9..779e42e7f1c2795c1e88d71511fc6f1513572ac9 100644 (file)
--- a/packaging/sdbd_device.service
+++ b/packaging/sdbd_device.service
@@ -12,6 +12,8 @@ EnvironmentFile=-/run/tizen-system-env
 PIDFile=/tmp/.sdbd.pid
 Restart=on-failure
 SmackProcessLabel=System
+Capabilities=cap_dac_override,cap_setgid,cap_setuid,cap_sys_admin=i
+SecureBits=keep-caps
 ExecStart=/usr/sbin/sdbd
 
 [Install]

diff --git a/packaging/sdbd_device_tv.service b/packaging/sdbd_device_tv.service
index fe3c965a700a9e28c95a8b0fb070c0feccd5d3ff..0ea497de801f9180e5fe1fffc34e498ced5779bf 100644 (file)
--- a/packaging/sdbd_device_tv.service
+++ b/packaging/sdbd_device_tv.service
@@ -11,6 +11,8 @@ EnvironmentFile=-/run/tizen-system-env
 OOMScoreAdjust=-1000
 PIDFile=/tmp/.sdbd.pid
 Restart=on-failure
+Capabilities=cap_dac_override,cap_setgid,cap_setuid,cap_sys_admin=i
+SecureBits=keep-caps
 ExecStart=/usr/sbin/sdbd
 
 [Install]

diff --git a/packaging/sdbd_emulator.service b/packaging/sdbd_emulator.service
index abd1605cc4352554e5e4622a139bdba89ff00c64..74c5d9b1c81eb2de0f1bf279c971fb7cfb9f9d0c 100644 (file)
--- a/packaging/sdbd_emulator.service
+++ b/packaging/sdbd_emulator.service
@@ -13,6 +13,8 @@ PIDFile=/tmp/.sdbd.pid
 RemainAfterExit=yes
 #ExecStartPre=/bin/bash -c "/bin/echo '10.0.2.15/32 system::debugging_network' >> /smack/netlabel"
 SmackProcessLabel=System
+Capabilities=cap_dac_override,cap_setgid,cap_setuid,cap_sys_admin=i
+SecureBits=keep-caps
 ExecStart=/bin/sh -c "/usr/sbin/sdbd `/usr/bin/awk '{match($0, /sdb_port=([0-9]+)/,port_match); match($0, /vm_name=([^, ]*)/,vm_match); print \"--emulator=\" vm_match[1] \":\" port_match[1] \" --connect-to=10.0.2.2:26099\" \" --sensors=10.0.2.2:\"port_match[1]+3 }' /proc/cmdline`"
 
 [Install]

diff --git a/packaging/sdbd_emulator_tv.service b/packaging/sdbd_emulator_tv.service
index 4d81fd222a1283d537548dd6cc3e0b7db28f7dc9..3627ded11ea09bd8e210dbacc43e5bd5e60d8191 100644 (file)
--- a/packaging/sdbd_emulator_tv.service
+++ b/packaging/sdbd_emulator_tv.service
@@ -12,6 +12,8 @@ Environment=DISPLAY=:0
 PIDFile=/tmp/.sdbd.pid
 RemainAfterExit=yes
 OOMScoreAdjust=-1000
+Capabilities=cap_dac_override,cap_setgid,cap_setuid,cap_sys_admin=i
+SecureBits=keep-caps
 #ExecStartPre=/bin/bash -c "/bin/echo '10.0.2.15/32 system::debugging_network' >> /smack/netlabel"
 ExecStart=/bin/sh -c "/usr/sbin/sdbd `/usr/bin/awk '{match($0, /sdb_port=([0-9]+)/,port_match); match($0, /vm_name=([^, ]*)/,vm_match); print \"--emulator=\" vm_match[1] \":\" port_match[1] \" --connect-to=10.0.2.2:26099\" \" --sensors=10.0.2.2:\"port_match[1]+3 }' /proc/cmdline`"
 

diff --git a/packaging/sdbd_tcp.service b/packaging/sdbd_tcp.service
index ade025cb594e6005a5021ae8f24b497d2ffb2595..5269cfe3ef78b1b3cf7565ebe0e7064029714a08 100644 (file)
--- a/packaging/sdbd_tcp.service
+++ b/packaging/sdbd_tcp.service
@@ -8,4 +8,6 @@ Environment=DISPLAY=:0
 PIDFile=/tmp/.sdbd.pid
 RemainAfterExit=yes
 SmackProcessLabel=System
+Capabilities=cap_dac_override,cap_setgid,cap_setuid,cap_sys_admin=i
+SecureBits=keep-caps
 ExecStart=/usr/sbin/sdbd --listen-port=26101