1
0
mirror of https://github.com/systemd/systemd.git synced 2024-10-31 07:51:21 +03:00
systemd/shell-completion/bash
Maanya Goenka dfbda8799c systemd-analyze: add new 'security' option to compare unit's overall exposure level with
--threshold option added to work with security verb and with the --offline option so that
users can determine what qualifies as a security threat. The threshold set by the user is
compared with the overall exposure level assigned to a unit file and if the exposure is
higher than the threshold, 'security' will return a non-zero exit status. The default value
of the --threshold option is 100.

Example Run:

1. testcase.service is a unit file created for testing the --threshold option

    maanya-goenka@debian:~/systemd (systemd-security)$ cat<<EOF>testcase.service

    > [Service]
    > ExecStart = echo hello
    > EOF

    For the purposes of this demo, the security table outputted below has been cut to show only the first two security settings.

    maanya-goenka@debian:~/systemd (systemd-security)$ sudo build/systemd-analyze security --offline=true testcase.service
    /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's
    process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'.
    Support for KillMode=none is deprecated and will eventually be removed.
    /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your
    unit file, and consider removing the setting altogether.
    /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating
    /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly.

      NAME                                        DESCRIPTION                                                       EXPOSURE
    ✗ PrivateNetwork=                             Service has access to the host's network                          0.5
    ✗ User=/DynamicUser=                          Service runs as root user                                         0.4

    → Overall exposure level for testcase.service: 9.6 UNSAFE 😨

    maanya-goenka@debian:~/systemd (systemd-security)$ echo $? 0

2. Next, we use the same testcase.service file but add an additional --threshold=60 parameter. We would expect 'security' to exit
   with a non-zero status because the overall exposure level (= 96) is higher than the set threshold (= 60).

    maanya-goenka@debian:~/systemd (systemd-security)$ sudo build/systemd-analyze security --offline=true --threshold=60 testcase.service
    /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's
    process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'.
    Support for KillMode=none is deprecated and will eventually be removed.
    /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your
    unit file, and consider removing the setting altogether.
    /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating
    /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly.

      NAME                                        DESCRIPTION                                                       EXPOSURE
    ✗ PrivateNetwork=                             Service has access to the host's network                          0.5
    ✗ User=/DynamicUser=                          Service runs as root user                                         0.4

    → Overall exposure level for testcase.service: 9.6 UNSAFE 😨

    maanya-goenka@debian:~/systemd (systemd-security)$ echo $? 1
2021-08-20 10:59:13 -07:00
..
bootctl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
busctl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
coredumpctl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
homectl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
hostnamectl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
journalctl license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 13:23:58 +09:00
kernel-install license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 13:23:58 +09:00
localectl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
loginctl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
machinectl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
meson.build meson: use a/b instead of join_paths(a,b) 2021-07-27 19:32:35 +02:00
networkctl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
portablectl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
resolvectl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
systemctl.in completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
systemd-analyze systemd-analyze: add new 'security' option to compare unit's overall exposure level with 2021-08-20 10:59:13 -07:00
systemd-cat bash-completion: localize words and cword variables 2021-04-06 16:15:13 +02:00
systemd-cgls bash-completion: localize words and cword variables 2021-04-06 16:15:13 +02:00
systemd-cgtop bash-completion: localize words and cword variables 2021-04-06 16:15:13 +02:00
systemd-delta completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
systemd-detect-virt bash-completion: localize words and cword variables 2021-04-06 16:15:13 +02:00
systemd-id128 completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
systemd-nspawn bash: update shell completion for new nspawn option 2021-05-07 22:44:35 +02:00
systemd-path bash-completion: localize words and cword variables 2021-04-06 16:15:13 +02:00
systemd-resolve completion/systemd-delta,-resolve: autocomplete with parameters 2021-06-22 14:56:47 +01:00
systemd-run Revert "Introduce ExitType" 2021-06-30 21:56:47 +02:00
timedatectl completion: fix 'unbound variables' errors 2021-06-22 14:56:47 +01:00
udevadm udevadm: introduce -a|--action option for test-builtin command 2021-08-18 00:08:08 +09:00