feat: 对deepin-face服务进行安全加固

对deepin-face服务进行安全加固

Task: https://pms.uniontech.com/task-view-361193.html

debian/rules

@@ -20,4 +20,5 @@ export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
 
 
 override_dh_auto_install:
-	dh_auto_install -- prefix=/usr
+	dh_auto_install -- prefix=/usr
+	dh_installtmpfiles deepin-face.tmpfiles

debian/tmpfiles

@@ -0,0 +1,2 @@
+#Type Path                      Mode User          Group         Age         Argument
+f     /var/log/deepin-face.log  0644 deepin-daemon deepin-daemon -           -

msic/dbus-conf/org.deepin.dde.Face1.conf

@@ -5,8 +5,8 @@
  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
 
-  <!-- Only root can own the service -->
-  <policy user="root">
+  <!-- Only deepin-daemon can own the service -->
+  <policy user="deepin-daemon">
     <allow own="org.deepin.dde.Face1"/>
   </policy>
 
@@ -15,7 +15,7 @@
     <allow send_destination="org.deepin.dde.Face1"/>
 
   </policy>
-  <policy user="root">
+  <policy user="deepin-daemon">
     <allow own="org.deepin.dde.Face1"/>
     <allow send_destination="org.deepin.dde.Face1" />
   </policy>

msic/systemd/deepin-face.service

@@ -1,9 +1,39 @@
 [Unit]
 Description=Deepin Face Authenticate Driver 
 
+# Ask for the dbus socket.
+Wants=dbus.socket
+After=dbus.socket
+
 [Service]
-User=root
 Type=dbus
-BusName=org.deepin.dde.Face1
+User=deepin-daemon
+SupplementaryGroups=video
+BusName=com.deepin.face
 ExecStart=/usr/libexec/deepin-face
 
+ProtectSystem=strict
+#ReadOnlyPaths=/usr/share/seetaface-models/
+ReadWritePaths=/var/log/deepin-face.log
+
+DeviceAllow=char-video4linux
+DevicePolicy=closed
+
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+PrivateMounts=yes
+PrivateTmp=yes
+# 需要video device
+#PrivateDevices=yes
+PrivateNetwork=yes
+PrivateUsers=yes
+RestrictNamespaces=yes
+LockPersonality=yes
+RestrictRealtime=yes
+RemoveIPC=yes
+MemoryDenyWriteExecute=yes
+# 内存占用TODO
+#MemoryLimit=100M