cronekorkn/left4me
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

deploy/hardening: allow x86 syscalls on web drop-in (steamcmd is 32-bit)

Browse source 
The web service handles install jobs by fork-exec'ing steamcmd_linux,
a 32-bit binary. With SystemCallArchitectures=native (x86_64 only) the
kernel SIGSYS-kills it on its first i386 syscall — surfaced as bash
exit 159 (= 128 + SIGSYS) in job logs. Mirror the server drop-in's
`native x86` so the install path works again; the server unit already
needed the same allowance for srcds_linux.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
mwiegand 2026-05-15 20:14:26 +02:00
parent 450f9f1591
commit 55b013833b
No known key found for this signature in database
2 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
deploy/files/etc/systemd/system/left4me-web.service.d/10-hardening.conf
View file

@ -28,7 +28,12 @@ ProtectClock=true
ProtectControlGroups=true ProtectControlGroups=true
ProtectHostname=true ProtectHostname=true
LockPersonality=true LockPersonality=true
SystemCallArchitectures=native # `native x86` (not just `native`) — the install job fork-execs
# steamcmd_linux, a 32-bit binary, which makes i386-numbered syscalls.
# Under `native` alone the kernel SIGSYS-kills it (bash exit 159 =
# 128+SIGSYS). Mirrors the server unit, which needs the same allowance
# for srcds_linux. See deploy/files/etc/systemd/system/left4me-server@.service.d/10-hardening.conf.
SystemCallArchitectures=native x86
SystemCallFilter=@system-service SystemCallFilter=@system-service
SystemCallFilter=~@debug @mount @raw-io @reboot @swap @cpu-emulation @obsolete SystemCallFilter=~@debug @mount @raw-io @reboot @swap @cpu-emulation @obsolete
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX

4
deploy/tests/test_example_units.py
View file

@ -261,7 +261,9 @@ def test_web_hardening_dropin_present_with_directives():
): ):
assert d in text, f"missing {d!r} in web hardening drop-in" assert d in text, f"missing {d!r} in web hardening drop-in"
# WEB-specific # WEB-specific
assert "SystemCallArchitectures=native" in text # `native x86` (not `native`) because the install job fork-execs
# steamcmd_linux (32-bit). Plain `native` produces SIGSYS (bash exit 159).
assert "SystemCallArchitectures=native x86" in text
assert "SystemCallFilter=@system-service" in text assert "SystemCallFilter=@system-service" in text
assert "SystemCallFilter=~@debug @mount @raw-io @reboot @swap @cpu-emulation @obsolete" in text assert "SystemCallFilter=~@debug @mount @raw-io @reboot @swap @cpu-emulation @obsolete" in text
# WEB must NOT include the sudo-incompatible directives. # WEB must NOT include the sudo-incompatible directives.