systemd:security_overview_of_systemd_services
This is an old revision of the document!
systemd - Security overview of systemd services
systemd enable services to run with a whole suite of hardening and sandboxing features from the Linux kernel.
The Linux kernel can filter and limit access to file systems, networks, devices, kernel capabilities and system calls (syscalls), and more.
Check current security
systemd-analyze security
returns:
UNIT EXPOSURE PREDICATE HAPPY ModemManager.service 5.8 MEDIUM 😐 NetworkManager.service 7.8 ^[[0;1;38;5;185mEXPOSED 🙁 accounts-daemon.service 9.6 UNSAFE 😨 acpid.service 9.6 UNSAFE 😨 alsa-state.service 9.6 UNSAFE 😨 anacron.service 9.6 UNSAFE 😨 apache2.service 9.2 UNSAFE 😨 apport.service 9.6 UNSAFE 😨 avahi-daemon.service 9.6 UNSAFE 😨 bluetooth.service 6.8 MEDIUM 😐 colord.service 8.8 ^[[0;1;38;5;185mEXPOSED 🙁 cron.service 9.6 UNSAFE 😨 cups-browsed.service 9.6 UNSAFE 😨 cups.service 9.6 UNSAFE 😨 dbus.service 9.6 UNSAFE 😨 dm-event.service 9.5 UNSAFE 😨 dmesg.service 9.6 UNSAFE 😨 emergency.service 9.5 UNSAFE 😨 expressvpn.service 9.6 UNSAFE 😨 gdm.service 9.8 UNSAFE 😨 geoclue.service 7.4 MEDIUM 😐 getty@tty1.service 9.6 UNSAFE 😨 grub-common.service 9.6 UNSAFE 😨 hddtemp.service 9.6 UNSAFE 😨 irqbalance.service 6.1 MEDIUM 😐 kerneloops.service 9.2 UNSAFE 😨 libvirtd.service 9.6 UNSAFE 😨 lvm2-lvmpolld.service 9.5 UNSAFE 😨 lxcfs.service 9.6 UNSAFE 😨 networkd-dispatcher.service 9.6 UNSAFE 😨 nvidia-persistenced.service 9.6 UNSAFE 😨 ondemand.service 9.6 UNSAFE 😨 php7.4-fpm.service 9.6 UNSAFE 😨 plymouth-start.service 9.5 UNSAFE 😨 polkit.service 9.6 UNSAFE 😨 rc-local.service 9.6 UNSAFE 😨 rescue.service 9.5 UNSAFE 😨 resolvconf.service 9.5 UNSAFE 😨 rsync.service 9.6 UNSAFE 😨 rsyslog.service 9.6 UNSAFE 😨 rtkit-daemon.service 7.1 MEDIUM 😐 snap.lxd.daemon.service 9.6 UNSAFE 😨 snapd.service 9.6 UNSAFE 😨 switcheroo-control.service 7.5 ^[[0;1;38;5;185mEXPOSED 🙁 systemd-ask-password-console.service 9.3 UNSAFE 😨 systemd-ask-password-plymouth.service 9.5 UNSAFE 😨 systemd-ask-password-wall.service 9.4 UNSAFE 😨 systemd-fsckd.service 9.5 UNSAFE 😨 systemd-initctl.service 9.3 UNSAFE 😨 systemd-journald.service 4.4 OK 🙂 systemd-logind.service 2.8 OK 🙂 systemd-machined.service 6.1 MEDIUM 😐 systemd-networkd.service 3.1 OK 🙂 systemd-resolved.service 2.2 OK 🙂 systemd-rfkill.service 9.3 UNSAFE 😨 systemd-timesyncd.service 2.1 OK 🙂 systemd-udevd.service 8.4 ^[[0;1;38;5;185mEXPOSED 🙁 thermald.service 9.6 UNSAFE 😨 udisks2.service 9.6 UNSAFE 😨 unattended-upgrades.service 9.6 UNSAFE 😨 upower.service 2.3 OK 🙂 user@1000.service 9.4 UNSAFE 😨 user@125.service 9.4 UNSAFE 😨 uuidd.service 4.5 OK 🙂 virtlockd.service 9.6 UNSAFE 😨 virtlogd.service 9.6 UNSAFE 😨 whoopsie.service 9.6 UNSAFE 😨 wpa_supplicant.service 9.6 UNSAFE 😨
NOTE: * Exposure score**: is entirely based on a service’s utilization of security features provided by systemd.
- It doesn’t consider security features built-in to the program or enforced by access control policies like Security-Enhanced Linux (SELinux) or AppArmor.
- Nor does the score in any way evaluate the risk factors of a program or its configuration.
Notice that many daemons, such as crond, are considered to be unsafe.
- That’s an accurate assessment as these services are designed to allow unrestricted execution of arbitrary commands.
- You may want to disable these services entirely unless you need them.
systemd/security_overview_of_systemd_services.1610540434.txt.gz · Last modified: 2021/01/13 12:20 by peter