gtnh-service-hardening #36

Closed

Lithium wants to merge 0 commits from gtnh-service-hardening into main

Lithium commented

2026-10-08 15:52:46 +02:00

Owner

Hardening the service to prevent escape hatches

ProtectSystem, ProtectHome, PrivateTmp, are used to prevent reading/writing to
outside locations
NoNewPrivileges, ProtectKernelTunables, ProtectControlGroups, are used
to prevent abusing privilege escalation exploits or techniques
ReadWritePaths is used to define where the service can Read/Write

This is probably as good as it gets for security.
This makes most exploits unusable.

It's probably a good idea to look into whether you can add or remove sudo from specific users.
It'd be really useful to be able to completely neuter a user from privilege escalation without rarely available RCEs.

In the end, the better way is to run the server inside a virtual machine.
The extra image size is barely anything if we keep to a minimal image.
We could also remove the tmux requirements by using a different linux distribution.

Hardening the service to prevent escape hatches - ProtectSystem, ProtectHome, PrivateTmp, are used to prevent reading/writing to outside locations - NoNewPrivileges, ProtectKernelTunables, ProtectControlGroups, are used to prevent abusing privilege escalation exploits or techniques - ReadWritePaths is used to define where the service can Read/Write This is probably as good as it gets for security. This makes most exploits unusable. It's probably a good idea to look into whether you can add or remove sudo from specific users. It'd be really useful to be able to completely neuter a user from privilege escalation without rarely available RCEs. In the end, the better way is to run the server inside a virtual machine. The extra image size is barely anything if we keep to a minimal image. We could also remove the tmux requirements by using a different linux distribution.

Lithium added 1 commit

2026-10-08 15:52:46 +02:00

gtnh-service-hardening b02890ff68

Hardening the service to prevent escape hatches
- ProtectSystem, ProtectHome, PrivateTmp, are used to prevent reading/writing to
  outside locations
- NoNewPrivileges, ProtectKernelTunables, ProtectControlGroups, are used
  to prevent abusing privilege escalation exploits or techniques
- ReadWritePaths is used to define where the service can Read/Write