systemd:security_overview_of_systemd_services
This is an old revision of the document!
systemd - Security overview of systemd services
systemd enable services to run with a whole suite of hardening and sandboxing features from the Linux kernel.
The Linux kernel can filter and limit access to file systems, networks, devices, kernel capabilities and system calls (syscalls), and more.
Check current security
systemd-analyze security
returns:
UNIT EXPOSURE PREDICATE HAPPY ModemManager.service 5.8 MEDIUM 😐 NetworkManager.service 7.8 ^[[0;1;38;5;185mEXPOSED 🙁 accounts-daemon.service 9.6 UNSAFE 😨 acpid.service 9.6 UNSAFE 😨 alsa-state.service 9.6 UNSAFE 😨 anacron.service 9.6 UNSAFE 😨 apache2.service 9.2 UNSAFE 😨 apport.service 9.6 UNSAFE 😨 avahi-daemon.service 9.6 UNSAFE 😨 bluetooth.service 6.8 MEDIUM 😐 colord.service 8.8 ^[[0;1;38;5;185mEXPOSED 🙁 cron.service 9.6 UNSAFE 😨 cups-browsed.service 9.6 UNSAFE 😨 cups.service 9.6 UNSAFE 😨 dbus.service 9.6 UNSAFE 😨 dm-event.service 9.5 UNSAFE 😨 dmesg.service 9.6 UNSAFE 😨 emergency.service 9.5 UNSAFE 😨 expressvpn.service 9.6 UNSAFE 😨 gdm.service 9.8 UNSAFE 😨 geoclue.service 7.4 MEDIUM 😐 getty@tty1.service 9.6 UNSAFE 😨 grub-common.service 9.6 UNSAFE 😨 hddtemp.service 9.6 UNSAFE 😨 irqbalance.service 6.1 MEDIUM 😐 kerneloops.service 9.2 UNSAFE 😨 libvirtd.service 9.6 UNSAFE 😨 lvm2-lvmpolld.service 9.5 UNSAFE 😨 lxcfs.service 9.6 UNSAFE 😨 networkd-dispatcher.service 9.6 UNSAFE 😨 nvidia-persistenced.service 9.6 UNSAFE 😨 ondemand.service 9.6 UNSAFE 😨 php7.4-fpm.service 9.6 UNSAFE 😨 plymouth-start.service 9.5 UNSAFE 😨 polkit.service 9.6 UNSAFE 😨 rc-local.service 9.6 UNSAFE 😨 rescue.service 9.5 UNSAFE 😨 resolvconf.service 9.5 UNSAFE 😨 rsync.service 9.6 UNSAFE 😨 rsyslog.service 9.6 UNSAFE 😨 rtkit-daemon.service 7.1 MEDIUM 😐 snap.lxd.daemon.service 9.6 UNSAFE 😨 snapd.service 9.6 UNSAFE 😨 switcheroo-control.service 7.5 ^[[0;1;38;5;185mEXPOSED 🙁 systemd-ask-password-console.service 9.3 UNSAFE 😨 systemd-ask-password-plymouth.service 9.5 UNSAFE 😨 systemd-ask-password-wall.service 9.4 UNSAFE 😨 systemd-fsckd.service 9.5 UNSAFE 😨 systemd-initctl.service 9.3 UNSAFE 😨 systemd-journald.service 4.4 OK 🙂 systemd-logind.service 2.8 OK 🙂 systemd-machined.service 6.1 MEDIUM 😐 systemd-networkd.service 3.1 OK 🙂 systemd-resolved.service 2.2 OK 🙂 systemd-rfkill.service 9.3 UNSAFE 😨 systemd-timesyncd.service 2.1 OK 🙂 systemd-udevd.service 8.4 ^[[0;1;38;5;185mEXPOSED 🙁 thermald.service 9.6 UNSAFE 😨 udisks2.service 9.6 UNSAFE 😨 unattended-upgrades.service 9.6 UNSAFE 😨 upower.service 2.3 OK 🙂 user@1000.service 9.4 UNSAFE 😨 user@125.service 9.4 UNSAFE 😨 uuidd.service 4.5 OK 🙂 virtlockd.service 9.6 UNSAFE 😨 virtlogd.service 9.6 UNSAFE 😨 whoopsie.service 9.6 UNSAFE 😨 wpa_supplicant.service 9.6 UNSAFE 😨
systemd/security_overview_of_systemd_services.1610540157.txt.gz · Last modified: 2021/01/13 12:15 by peter