From 36ae846caa43efba519efcc35fcd646754fb2da2 Mon Sep 17 00:00:00 2001 From: Sascha Date: Wed, 29 Jul 2026 19:01:39 +0200 Subject: [PATCH] fix: clarify NoNewPrivileges handling in audit-webhook.service --- backend/deploy/audit-webhook.service | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/backend/deploy/audit-webhook.service b/backend/deploy/audit-webhook.service index 52c7f5d..239da92 100644 --- a/backend/deploy/audit-webhook.service +++ b/backend/deploy/audit-webhook.service @@ -17,7 +17,17 @@ RestartSec=5 # Unlike audit-endpoint.service, this one genuinely needs to write to the # checkout (git reset --hard, npm install), hence ReadWritePaths below - # everything else stays as locked down as the main service. -NoNewPrivileges=true +# +# NoNewPrivileges is deliberately NOT set here, unlike audit-endpoint.service: +# it flips the kernel's PR_SET_NO_NEW_PRIVS flag, which makes setuid bits +# (including /usr/bin/sudo's) inert for this process and everything it execs. +# deploy.sh's whole reason for running as this user is to call +# `sudo systemctl restart audit-endpoint` - a privilege escalation that is +# exactly what that flag exists to prevent. The two are fundamentally +# incompatible, not a configuration mistake to work around. +# The actual containment for that escalation is the narrow sudoers rule +# (audit-deploy-sudoers): exactly two "systemctl restart " commands, +# nothing else, regardless of this flag. PrivateTmp=true PrivateDevices=true ProtectSystem=strict