JezK

Edit File: imunify360.service

[Unit] Description=Imunify360 resident Before=cagefs.service After=network.target iptables.service firewalld.service systemd-modules-load.service Wants=ossec-hids.service imunify360-php-daemon.service imunify-realtime-av.service imunify-notifier.socket # Service will NOT start if this file exists ConditionPathExists=!/var/lib/rpm-state/imunify360-transaction-in-progress [Service] CPUAccounting=true MemoryAccounting=true BlockIOAccounting=true Slice=Imunify-agent.slice Environment=PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=upb Environment=LANG=en_US.UTF-8 Environment=LC_ALL=en_US.UTF-8 Environment=PYTHONNOUSERSITE=1 Environment=IMUNIFY360_LOGGING_PREFIX=r. Environment=SQLITE_TMPDIR=/var/imunify360/tmp Environment=FGW_FS_BASE_DIR=/var/imunify360/gw.dir Environment=FGW_FS_MAX_CONCURRENT_QUEUES=100 # NATS embedded server for cross-component messaging (DEF-39879) Environment=I360_NATS_ENABLED=true Environment=I360_NATS_STORE_DIR=/var/imunify360/nats Environment=I360_NATS_PORT=44222 Environment=I360_NATS_TOKEN_PATH=/var/run/imunify360/nats.token # Manage /var/run/imunify360/ manually instead of using systemd's RuntimeDirectory=. # RuntimeDirectoryPreserve=yes was added in systemd v235 and is silently ignored on # systemd v219 (CloudLinux 7); without preserve, RuntimeDirectory= would delete the # directory on service stop, wiping wafd_imunify_daemon's libiplists-daemon.sock and # breaking webshield until wafd is manually restarted (DEF-41462). Type=notify ExecStartPre=/bin/mkdir -p /var/run/imunify360 ExecStartPre=/bin/chmod 0755 /var/run/imunify360 ExecStartPre=/usr/share/imunify360/scripts/set-service-resources.sh imunify360.service 50 50 ExecStart=/usr/bin/imunify-service ExecStartPost=/bin/bash -c "echo $MAINPID > /var/run/imunify360.pid" ExecStartPost=/bin/systemctl restart imunify360-resource-unlock@imunify360.timer PIDFile=/var/run/imunify360.pid #TODO: must be not less than defence360agent/cli/server.py:stop(seconds=8) TimeoutStartSec=900 TimeoutStopSec=60 Restart=on-failure RestartSec=5 StartLimitInterval=600s StartLimitBurst=5 # Don't send SIGTERM on service stop to remaining processes in cgroup # (SIGKILL on timeout is still sent) KillMode=mixed # NoNewPrivileges=true # CapabilityBoundingSet=CAP_BPF CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_KILL CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_PERFMON CAP_SETGID CAP_SETUID CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYS_RESOURCE # AmbientCapabilities= covers caps subprocesses need as effective. # NoNewPrivileges=true disables the kernel's "raise effective from # permitted on UID-0 exec" path, so without Ambient children run with # effective=empty and fail with EPERM. Why each non-obvious cap is here: # - CAP_NET_RAW: iptables-1.8.5's xt_set extension opens # AF_INET SOCK_RAW IPPROTO_RAW (libxt_set.c:get_version) to probe # ipset; EPERM here is reported as "Can't open socket to ipset". # - CAP_BPF / CAP_PERFMON / CAP_SYS_ADMIN: the agent's Go firewall # stack creates a BPF map (nats_port) via bpf(BPF_MAP_CREATE); # fails with "operation not permitted" without these. # - CAP_SYS_RESOURCE: cagefsctl opens /proc/lve/list to probe the # CloudLinux LVE kernel module before any other operation; the # LVE handler gates that open on CAP_SYS_RESOURCE, and EPERM # there is reported as "Error: current running kernel is NOT # supported" (misleading — the kernel IS supported, the caller # just lacks the cap). Verified by strace + bisect on CL9 + CSF. # - The rest are baseline daemon caps: CHOWN/FOWNER/SETUID/SETGID for # managing per-user file ownership during malware fixes; # DAC_OVERRIDE / DAC_READ_SEARCH for traversing system dirs; # SYS_PTRACE for the agent's own diagnostic helpers. # AmbientCapabilities=CAP_BPF CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_KILL CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_PERFMON CAP_SETGID CAP_SETUID CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYS_RESOURCE # ProtectSystem=true keeps /usr, /boot, /efi read-only. We previously # tried =full (which also locks /etc) but every concrete failure in # this MR's review came from panel-provided tools that the agent # invokes as subprocesses (whmapi, custombuild, server_pref, # rebuildhttpdconf, ie_config, cagefsctl, …) needing to write # somewhere under /etc/. The allowlist for those grew to ~20 entries # and was still racy on fresh installs (companion packages create # their /etc/ dirs after the unit starts; `-` prefix entries are # evaluated at start time and silently skipped). =true gets us out # of the wack-a-mole and still delivers the MR's stated security # goal — preventing privilege escalation — via NoNewPrivileges=true # and CapabilityBoundingSet=. The /etc/* ReadWritePaths= entries # below are now redundant under =true; kept for documentation and # resilience if =true is ever reverted to =full. ProtectSystem=false # ReadWritePaths=/etc/sysconfig/imunify360 # ReadWritePaths=/etc/imunify360 # ReadWritePaths=/etc/imunify-agent-proxy # ReadWritePaths=/etc/cron.d # Optional ('-' prefix): wafd/webshield ship in companion packages and # may not be present at service start (e.g. fresh install); panel # integration dirs only exist on specific distros. # ReadWritePaths=-/etc/imunify360-wafd # ReadWritePaths=-/etc/imunify360-webshield # ReadWritePaths=-/etc/csf # ReadWritePaths=-/etc/httpd/conf.d # ReadWritePaths=-/etc/httpd/conf/plesk.conf.d # ReadWritePaths=-/etc/httpd/conf/extra # ReadWritePaths=-/etc/apache2/conf.d # ReadWritePaths=-/etc/apache2/conf-enabled # ReadWritePaths=-/etc/apache2/plesk.conf.d # ReadWritePaths=-/etc/modsecurity.d # ReadWritePaths=-/etc/yum.repos.d # ReadWritePaths=-/etc/apt/sources.list.d # Additional dirs the agent rewrites at runtime, surfaced by build 523: # - /usr/share/i360-php-opts: proactive-defense PHP-immunity DB # (im360/subsys/proactive.py + i360-storage-replacehdb-v2 helper). # - /etc/httpd/conf/modsecurity.d: Plesk modsec rules (RBL whitelist, # malware-list .tmp tempfiles); sibling of plesk.conf.d, not a child. # - /usr/local/directadmin: DA modsec includes and per-user domain # files rewritten on each sync. # ReadWritePaths=-/usr/share/i360-php-opts # ReadWritePaths=-/etc/httpd/conf/modsecurity.d # ReadWritePaths=-/usr/local/directadmin # Additional cPanel + CageFS dirs surfaced by build 535: # - /usr/local/cpanel: where the cPanel hook installer drops # ImunifyHook.pm. # - /etc/cagefs, /var/cagefs, /usr/share/cagefs, /usr/share/cagefs-skeleton: # rewritten by `cagefsctl --force-update-etc` which the agent's cagefs plugin # spawns; without these the subprocess hangs and the agent's # asyncio cancel surfaces as cascading test setup failures. # /usr/share/cagefs-skeleton is a SEPARATE top-level dir (not under # /usr/share/cagefs); cagefsctl's check_skeleton() does os.chmod() on it, # which raises EROFS under ProtectSystem=. On a CageFS host the resulting # cagefsctl failure makes migration 129_fixed_cagefs_unmount fall back to a # synchronous `systemctl restart cagefs`, which deadlocks against # Before=cagefs.service and hangs agent startup (DEF-47738). # ReadWritePaths=-/usr/local/cpanel # ReadWritePaths=-/etc/cagefs # ReadWritePaths=-/var/cagefs # ReadWritePaths=-/usr/share/cagefs # ReadWritePaths=-/usr/share/cagefs-skeleton # Plesk plugin scripts dir (build 550): the agent installs/updates # /usr/local/psa/admin/plib/modules/imunify360/scripts/ on hooks. # ReadWritePaths=-/usr/local/psa/admin/plib/modules/imunify360 # Plesk runtime state — notification log written by send-notifications.php # (/usr/local/psa/var/modules/imunify360/imunify360-local.log) and the # plesk-sendmail spool/tempfile dir. ProtectSystem=true bind-mounts /usr # read-only and CAP_DAC_OVERRIDE cannot bypass a mount-layer RO, so the # Plesk notification hook fails with EACCES without this entry. # ReadWritePaths=-/usr/local/psa/var # Webuzo keeps Apache (and the modsec audit log) under /usr/local/apps; # the resident-agent's modsec sensor tails that log and persists its read # position to a <auditlog>.filetail.state file beside it. ProtectSystem=true # bind-mounts /usr read-only, so without this the state write fails with EROFS. # ReadWritePaths=-/usr/local/apps # LiteSpeed keeps its config tree under /usr/local/lsws, including the # per-domain <domain>.d/modsec.conf files rewritten by the agent's # integration.sh rewrite-domain-configs. ProtectSystem=true makes /usr # read-only, so without this carve-out the per-domain modsec rewrite fails # with EROFS. # ReadWritePaths=-/usr/local/lsws # CSF installs its post-hook script as /usr/local/csf/bin/csfpost.sh (preferred # over /etc/csf/csfpost.sh when present); the ExportWBList plugin rewrites it # on activation. ProtectSystem=true makes /usr read-only, so without this # carve-out the rewrite fails with EROFS. # ReadWritePaths=-/usr/local/csf # PrivateTmp= deliberately not set. Tried =yes in v9.x and reverted: # the agent and several subsystems share /tmp with co-resident # processes — pytest fixtures touch /tmp/sample_enabled to enable # the Sample backup backend (rpm-tests/utils/backups.py), and the # realtime inotify malware scanner watches user-controlled paths # including /tmp on production hosts (PHP session/upload files). # A private /tmp namespace silently hides both. The security goal # of preventing /tmp data leaks is mostly carried by ProtectSystem= # and NoNewPrivileges= already. [Install] WantedBy=multi-user.target