locking down your systemd services - linuxcon europe, berlin
TRANSCRIPT
![Page 1: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/1.jpg)
Locking Down Your systemd Services
LinuxCon Europe, Berlin
October 2016
Locking Down Your systemd Services
![Page 2: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/2.jpg)
systemd
Service Management
Security
Locking Down Your systemd Services
![Page 3: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/3.jpg)
systemd
Service Management
Security
Locking Down Your systemd Services
![Page 4: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/4.jpg)
systemd
Service Management
Security
Locking Down Your systemd Services
![Page 5: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/5.jpg)
Unit Files
Service Files
Locking Down Your systemd Services
![Page 6: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/6.jpg)
Unit Files
Service Files
Locking Down Your systemd Services
![Page 7: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/7.jpg)
[Unit]Description=Router Advertisement Daemon for IPv6
[Service]ExecStart=/usr/sbin/radvdType=forkingPIDFile=/var/run/radvd/radvd.pid
[Install]WantedBy=multi-user.target
Locking Down Your systemd Services
![Page 8: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/8.jpg)
[Unit]Description=Router Advertisement Daemon for IPv6
[Service]ExecStart=/usr/sbin/radvdType=forkingPIDFile=/var/run/radvd/radvd.pidPrivateTmp=yesProtectSystem=fullProtectHome=yes
[Install]WantedBy=multi-user.target
Locking Down Your systemd Services
![Page 9: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/9.jpg)
User=
DynamicUser=
Locking Down Your systemd Services
![Page 10: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/10.jpg)
User=
DynamicUser=
Locking Down Your systemd Services
![Page 11: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/11.jpg)
CapabilityBoundingSet=
SecureBits=
Locking Down Your systemd Services
![Page 12: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/12.jpg)
CapabilityBoundingSet=
SecureBits=
Locking Down Your systemd Services
![Page 13: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/13.jpg)
PrivateTmp=
Locking Down Your systemd Services
![Page 14: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/14.jpg)
PrivateDevices=
Locking Down Your systemd Services
![Page 15: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/15.jpg)
PrivateNetwork=
Locking Down Your systemd Services
![Page 16: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/16.jpg)
ProtectSystem=no|yes|full|strict
Locking Down Your systemd Services
![Page 17: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/17.jpg)
ReadWritePaths=
ReadOnlyPaths=
InaccessiblePaths=
Locking Down Your systemd Services
![Page 18: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/18.jpg)
ReadWritePaths=
ReadOnlyPaths=
InaccessiblePaths=
Locking Down Your systemd Services
![Page 19: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/19.jpg)
ReadWritePaths=
ReadOnlyPaths=
InaccessiblePaths=
Locking Down Your systemd Services
![Page 20: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/20.jpg)
PrivateUsers=
Locking Down Your systemd Services
![Page 21: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/21.jpg)
RootDirectory=
Locking Down Your systemd Services
![Page 22: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/22.jpg)
ProtectKernelTunables=
Locking Down Your systemd Services
![Page 23: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/23.jpg)
ProtectControlGroups=
Locking Down Your systemd Services
![Page 24: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/24.jpg)
MountFlags=slave
Locking Down Your systemd Services
![Page 25: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/25.jpg)
NoNewPrivileges=
Locking Down Your systemd Services
![Page 26: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/26.jpg)
SystemCallFilter=
Example: SystemCallFilter=~@clock @ipc
Locking Down Your systemd Services
![Page 27: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/27.jpg)
SystemCallFilter=
Example: SystemCallFilter=~@clock @ipc
Locking Down Your systemd Services
![Page 28: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/28.jpg)
SystemCallArchitecture=
Locking Down Your systemd Services
![Page 29: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/29.jpg)
RestrictAddressFamilies=
Locking Down Your systemd Services
![Page 30: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/30.jpg)
MemoryDenyWriteExecute=
Locking Down Your systemd Services
![Page 31: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/31.jpg)
RestrictRealtime=
Locking Down Your systemd Services
![Page 32: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/32.jpg)
DeviceAllow=
Locking Down Your systemd Services
![Page 33: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/33.jpg)
SELinuxContext=
AppArmorProfile=
SmackProcessLabel=
Locking Down Your systemd Services
![Page 34: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/34.jpg)
SELinuxContext=
AppArmorProfile=
SmackProcessLabel=
Locking Down Your systemd Services
![Page 35: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/35.jpg)
SELinuxContext=
AppArmorProfile=
SmackProcessLabel=
Locking Down Your systemd Services
![Page 36: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/36.jpg)
Future:
ProtectKernelLogs=
ProtectClock=
ProtectKernelModules=
ProtectTracing=
ProtectMount=
RestrictNamespaces=
Locking Down Your systemd Services
![Page 37: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/37.jpg)
Future:
ProtectKernelLogs=
ProtectClock=
ProtectKernelModules=
ProtectTracing=
ProtectMount=
RestrictNamespaces=
Locking Down Your systemd Services
![Page 38: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/38.jpg)
Future:
ProtectKernelLogs=
ProtectClock=
ProtectKernelModules=
ProtectTracing=
ProtectMount=
RestrictNamespaces=
Locking Down Your systemd Services
![Page 39: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/39.jpg)
Future:
ProtectKernelLogs=
ProtectClock=
ProtectKernelModules=
ProtectTracing=
ProtectMount=
RestrictNamespaces=
Locking Down Your systemd Services
![Page 40: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/40.jpg)
Future:
ProtectKernelLogs=
ProtectClock=
ProtectKernelModules=
ProtectTracing=
ProtectMount=
RestrictNamespaces=
Locking Down Your systemd Services
![Page 41: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/41.jpg)
Future:
ProtectKernelLogs=
ProtectClock=
ProtectKernelModules=
ProtectTracing=
ProtectMount=
RestrictNamespaces=
Locking Down Your systemd Services
![Page 42: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/42.jpg)
Future:
ProtectKernelLogs=
ProtectClock=
ProtectKernelModules=
ProtectTracing=
ProtectMount=
RestrictNamespaces=
Locking Down Your systemd Services
![Page 43: Locking Down Your systemd Services - LinuxCon Europe, Berlin](https://reader034.vdocuments.site/reader034/viewer/2022042600/5870a8831a28ab31318b58b6/html5/thumbnails/43.jpg)
That’s all, folks!
Locking Down Your systemd Services