Summary: These changes help ensure that phd starts more reliably and should phd itself, or one of its dependencies (such as `git`, or `hg`) become somehow compromised, the blast radius is minimized. - Improve the startup characteristics - use `syslog.socket` as `syslog.target` isn't guaranteed by systemd. - use `network-online.target` rather than `network.target` under the common assumption that mysql is on another host. - defensively order after `local-fs.target`. - Improve service hardening - `ProtectHome=tmpfs`: ensure that arbitrary home directories are invisible. - `ProtectHostname=yes`: prevent changing the system hostname. - `ProtectKernelLogs=yes`: prevent access to kernel (dmesg) logs. - `ProtectKernelModules=yes`: prevent access/modification to loaded modules. - `ProtectKernelTunables=yes`: prevent modification sysctls and some `/proc` parameters. - `ProtectSystem=full`: make `/boot`, `/efi`, `/usr`, and `/etc` read-only. - `ProtectProc=invisible`: hide other than itself and those it spawned from itself. - `ProtectControlGroups=strict`: hide other cgroups, and prevent modifications. - `PrivateDevices=yes`: only expose essential devices e.g. `/dev/null`. - `PrivateIPC=yes`: restrict mostly legacy IPC mechanisms (i.e., SysV IPC). - `PrivateTmp=yes`: give phd private temporary directories `/tmp`, `/var/tmp`. This helps make temporary files safer and improves service behavior since systemd will clean up these directories after every service stop. - `PrivateUsers=yes`: make only `root`, `nobody`, and the configured `daemon-user` visible. The `nobody` is mapped to the entire rest of the uid space, precluding even knowledge of other user account or groups. Test Plan: I deployed these units on my production install of Phorge and everything kept working. I used the following systemd drop-in specify my install's configuration: ```lang=ini,name=/etc/systemd/system/phorge-phd.service.d/override.conf [Service] User=phd Group=phd # repository storage root ReadWritePaths=/data # phd log directory ReadWritePaths=/var/log/phorge ``` Reviewers: avivey, O1 Blessed Committers Reviewed By: avivey, O1 Blessed Committers Subscribers: tobiaswiese, valerio.bozzolan, Matthew, Cigaryno Differential Revision: https://we.phorge.it/D26216