#996927 Drop NSCD_SOCKET_OLD and harden systemd unit?

Package:
unscd
Source:
unscd
Description:
Micro Name Service Caching Daemon
Submitter:
"Trent W. Buck"
Date:
2021-10-20 22:00:04 UTC
Severity:
wishlist
#996927#5
Date:
2021-10-20 21:04:55 UTC
From:
To:
I wrote a hardening dropin (attached) for unscd.service.

    $ systemd-analyze security
    UNIT           EXPOSURE PREDICATE HAPPY
    unscd.service       9.6 UNSAFE    😨      # before
    unscd.service       1.1 OK        🙂      # after

Please consider adding some/all of it to debian/unscd.service.
You may need to "dial back" the hardening a little, e.g.
PADL libnss-ldap (dead since 2016, but still in Debian 11) probably needs AF_INET AF_INET6.

Two further improvements require source code changes:

  * Removing NSCD_SOCKET_OLD from nscd.c.
    I *think* glibc hasn't used this path for over a decade now!
    Removing it will allow systemd to block write access to /run.

  * Make unscd only drop privileges if it starts as root (or so).
    This will allow systemd to drop privileges before unscd starts, and
    block CAP_SET[UG]ID and sete[ug]id(2).

I am using unscd with its default nscd.conf.
It provides a short-term cache for nss-pam-ldapd,
reducing the load on the LDAP server (slapd or samba-ad) by 90% to 99%.

My test case was to do this (testing passwd negative-ttl only) :

    # for i in {1..9999}; do touch "$i"; chown -h 1234 "$i"; done
    # time find -nouser -fprintf /dev/null .
    real    0m1.176s        # unscd is stopped
    real    0m0.446s        # unscd is running

With my dropin, this test still passes, so I think unscd is both running and working.
#996927#10
Date:
2021-10-20 21:57:23 UTC
From:
To:
Trent W. Buck wrote:

That's a typo, it should be "RuntimeDirectory=nscd".
Testing didn't catch it until I did a reboot, because
the non-systemd doesn't remove /run/nscd when unscd stops.