Bug 1223071 - earlyoom 1.8-1.1 systemd service hardening incorrect value for IPAddressDeny
Summary: earlyoom 1.8-1.1 systemd service hardening incorrect value for IPAddressDeny
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Other (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: David B
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-18 11:10 UTC by David B
Modified: 2024-05-17 13:31 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David B 2024-04-18 11:10:58 UTC 
I've noticed earlyoom 1.8-1.1 received new hardening options in it's systemd service configuration but the IPAddressDeny seems to have an incorrect value.

From the logs:
> bal. 18 10:58:40 systemd[1]: /usr/lib/systemd/system/earlyoom.service:41: Invalid address prefix is specified in [Service] IPAddressDeny=, ignoring assignment: true

Right now it's
IPAddressDeny=true

but it's not a boolean, it should be a list of IPv4 and/or IPv6 addresses (or one of the symbolic names) as according to https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html#IPAddressAllow=ADDRESS%5B/PREFIXLENGTH%5D%E2%80%A6

I believe it should be
IPAddressDeny=any
since I don't think earlyoom needs any network access.
Comment 1 David B 2024-04-18 15:04:55 UTC 
I've found that the service configuration comes from upstream so I created a pull request there https://github.com/rfjakob/earlyoom/pull/312
Comment 2 Chenzi Cao 2024-04-30 08:28:45 UTC 
Hi David, it seems you already submit fix for this bug report, so I assign it to you, please feel free to reassign whenever necessary, thanks.
Comment 3 David B 2024-05-17 13:31:41 UTC 
Fixed in 1.8.2 - already in Tumbleweed.