Question concerning ProtectKernelModules setting in systemd service #378

New Issue

csteinforth · 2020-12-08T07:17:44Z

csteinforth commented

2020-12-08 07:17:44 +00:00

What I'm trying to do and why

I run borgmatic via systemd and the borgmatic.timer and borgmatic.service in order to make a full backup of my system. When running borgmatic create the directory /usr/lib/modules is included, but when running the automatic backup via the systemd service the content of the directory is missing, I guess due to the ProtectKernelModules=yessetting. Do I have to turn this to "off" in order to backup this directory too?

Steps to reproduce (if a bug)

location:
    source_directories:
        - /

    repositories:
        - /mnt/data/EOSSystem

    exclude_patterns:
        - /dev
        - /run
        - /sys
        - /home
        - ...

My systemd service and timer are unchanged from here.

Actual behavior (if a bug)

Expected behavior (if a bug)

Other notes / implementation ideas

Environment

My version information is unchanged from here.

#### What I'm trying to do and why I run borgmatic via systemd and the borgmatic.timer and borgmatic.service in order to make a full backup of my system. When running `borgmatic create` the directory `/usr/lib/modules` is included, but when running the automatic backup via the systemd service the content of the directory is missing, I guess due to the `ProtectKernelModules=yes`setting. Do I have to turn this to "off" in order to backup this directory too? #### Steps to reproduce (if a bug) ``` location: source_directories: - / repositories: - /mnt/data/EOSSystem exclude_patterns: - /dev - /run - /sys - /home - ... ``` My systemd service and timer are unchanged from [here](https://projects.torsion.org/witten/borgmatic/issues/376#issue-563). #### Actual behavior (if a bug) --- #### Expected behavior (if a bug) --- #### Other notes / implementation ideas #### Environment My version information is unchanged from [here](https://projects.torsion.org/witten/borgmatic/issues/376#issue-563).

csteinforth commented

2020-12-08 13:17:46 +00:00

I just read over #352 and #354. Is ProtectKernelModule just a recommendation here? @palto42 could you check this?

palto42 commented

2020-12-08 18:32:56 +00:00

@csteinforth I don't think that your issue is related to ProtectKernelModules since this is about dynamic loading of kernel modules (as the same suggests).

My first thought was that the reason why some /usr/lib/modules are exclued is more likely the setting of ProtectSystem, but from the documentation this should onyl make that paths read-only. Currently it's not clear to why any of this settings may exclude /usr/lib/modules.

I would disable (comment-out with #) all the systemd service security settings and if this solves the problem, re-enable them one by one to check which one causes your problem.

All this settings are optional to improve system security, so you can disable some if it causes issues for your use case.

@csteinforth I don't think that your issue is related to [ProtectKernelModules](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectKernelModules=) since this is about dynamic loading of kernel modules (as the same suggests). My first thought was that the reason why some `/usr/lib/modules` are exclued is more likely the setting of [ProtectSystem](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectSystem=), but from the documentation this should onyl make that paths read-only. Currently it's not clear to why any of this settings may exclude `/usr/lib/modules`. I would disable (comment-out with #) all the systemd service security settings and if this solves the problem, re-enable them one by one to check which one causes your problem. All this settings are optional to improve system security, so you can disable some if it causes issues for your use case.

csteinforth commented

2020-12-08 19:05:09 +00:00

@palto42 thanks four answer. According to the documentation /usr/lib/modules is made inaccessible (whatever that means), so I will start with this one to comment out actually.

Edit: I disabled ProtectKernelModuleand /usr/lib/modules is part of my backup. So this seems to solve the problem.

All this settings are optional to improve system security, so you can disable some if it causes issues for your use case.

This is a really valuable information. I suspected that those settings are mandatory somehow, but if disabling is possible this should solve my issue here.

@witten do you think it would be a good idea to add a comment on this to the system example file?

@palto42 thanks four answer. According to the [documentation](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectKernelModules=) `/usr/lib/modules` is made inaccessible (whatever that means), so I will start with this one to comment out actually. Edit: I disabled `ProtectKernelModule`and `/usr/lib/modules` is part of my backup. So this seems to solve the problem. > All this settings are optional to improve system security, so you can disable some if it causes issues for your use case. This is a really valuable information. I suspected that those settings are mandatory somehow, but if disabling is possible this should solve my issue here. @witten do you think it would be a good idea to add a comment on this to the system example file?

palto42 commented

2020-12-08 19:36:31 +00:00

@csteinforth You are right, I overlooked the hint in the ProtectKernelModules description that it makes /usr/lib/modules inaccessible.

Not fully sure, but it seems to me that it's not possible to allow read-only access to this path with the setting of ReadOnlyPaths= as it mentions that the InaccessiblePathsdon't support nested ReadOnlyPaths.

So only optin seems to disable ProtectKernelModules in order to backup /usr/lib/modules.

@csteinforth You are right, I overlooked the hint in the [ProtectKernelModules](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectKernelModules=) description that it makes `/usr/lib/modules` inaccessible. Not fully sure, but it seems to me that it's not possible to allow read-only access to this path with the setting of [`ReadOnlyPaths=`](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ReadWritePaths=) as it mentions that the `InaccessiblePaths`don't support nested `ReadOnlyPaths`. So only optin seems to disable ProtectKernelModules in order to backup `/usr/lib/modules`.

👍 1

witten commented

2020-12-09 18:09:17 +00:00

do you think it would be a good idea to add a comment on this to the system example file?

Good idea.. Done! I'll mark this ticket as resolved.. Let me know if there's anything else. Thanks @palto42 for fielding it.

> do you think it would be a good idea to add a comment on this to the system example file? Good idea.. Done! I'll mark this ticket as resolved.. Let me know if there's anything else. Thanks @palto42 for fielding it.

witten closed this issue

2020-12-09 18:09:22 +00:00

witten added the

question / support

label 2020-12-09 18:10:31 +00:00

Sign in to join this conversation.