{"push_id":713616919,"size":1,"distinct_size":1,"ref":"refs/heads/production","head":"027447f35c0f740b863487a10274ae45f1ad4d6f","before":"ef118bef3fc42435a816c95b24679942e17f4463","commits":[{"sha":"027447f35c0f740b863487a10274ae45f1ad4d6f","author":{"email":"a9e12a0458cdd09ffa8706c2554286a97748692c@wikimedia.org","name":"Moritz Muehlenhoff"},"message":"Allow optional firejail containment for nodejs services.\n\nThis has been initially tested with mathoid and after we flip\nthe services one-by-one, the firejail conditional can be dropped,\nmaking firejail the default for all future node services.\n\nThe current configuration runs every nodefs service an isolated\nLinux namespace with\n- read-only system directories (like /usr or /lib)\n- private PID space\n- private /tmp (using tmpfs)\n- /root and /home/* blacklisted\n- reduced capabilities: CAP_SYS_MODULE, CAP_SYS_RAWIO, CAP_SYS_BOOT,\n  CAP_SYS_NICE, CAP_SYS_TTY_CONFIG, CAP_SYSLOG, CAP_MKNOD, CAP_SYS_ADMIN\n- filtered syscalls: mount, umount2, ptrace, kexec_load, open_by_handle_at,\n  init_module, finit_module, delete_module, iopl,ioperm, swapon, swapoff,\n  mknode, syslog, process_vm_readv and process_vm_writev, sysfs,_sysctl,\n  adjtimex, clock_adjtime, lookup_dcookie, perf_event_open, fanotify_init\n  kcmp\n\nBug: T101870\nChange-Id: I7e9c8d1c3f7d6655bba598938eba885210c9e9d6","distinct":true,"url":"https://api.github.com/repos/wikimedia/operations-puppet/commits/027447f35c0f740b863487a10274ae45f1ad4d6f"}]}