From 479a219feeefba01d4dae28782515980bc346825 Mon Sep 17 00:00:00 2001 From: Amrita Date: Tue, 17 Sep 2024 17:12:35 +0530 Subject: [PATCH 1/6] adds asm file --- articles/systemd-securing.asm.xml | 35 +++++++++++++++++-------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/articles/systemd-securing.asm.xml b/articles/systemd-securing.asm.xml index eabc9892f..2831144d2 100644 --- a/articles/systemd-securing.asm.xml +++ b/articles/systemd-securing.asm.xml @@ -19,9 +19,13 @@ + + - + + + @@ -42,7 +46,7 @@ - + - + @@ -150,7 +150,6 @@ - How to analyze the security of a &systemd; service From 2938f4a167468db922426d90a9d87a4f1867f748 Mon Sep 17 00:00:00 2001 From: Amrita Date: Tue, 10 Dec 2024 16:03:41 +0530 Subject: [PATCH 4/6] review feedback-1 --- articles/systemd-securing.asm.xml | 2 +- concepts/systemd-securing.xml | 2 +- tasks/systemd-example-secure-service.xml | 10 +++++----- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/articles/systemd-securing.asm.xml b/articles/systemd-securing.asm.xml index 302f207be..c8aeef7f8 100644 --- a/articles/systemd-securing.asm.xml +++ b/articles/systemd-securing.asm.xml @@ -70,7 +70,7 @@ --> &x86-64; - &power; + &power;How to improve the overall exposure &productname; diff --git a/concepts/systemd-securing.xml b/concepts/systemd-securing.xml index 41fdc1983..60f13b16d 100644 --- a/concepts/systemd-securing.xml +++ b/concepts/systemd-securing.xml @@ -52,7 +52,7 @@ A detailed analysis of the security settings is executed and displayed. If a service unit is not specified, all currently loaded, long-running service units are inspected and the results are displayed in a terse table. -The command upon checking the security settings, assigns a numeric value , also known as exposure level. +Upon checking the security settings, the command assigns a numeric value , also known as exposure level. This value is dependent on how important a setting is. It then calculates an overall exposure level for the whole unit. This value ranges from 0.0-10.0, which is an indicator of how exposed a service is security wise. High exposure levels indicate that the service might benefit from additional security settings. diff --git a/tasks/systemd-example-secure-service.xml b/tasks/systemd-example-secure-service.xml index 9c375146d..97e50a37e 100644 --- a/tasks/systemd-example-secure-service.xml +++ b/tasks/systemd-example-secure-service.xml @@ -49,7 +49,7 @@ NAME DESCRIPTION EXPOSURE
- How to improve the overall exposure with options? + How to improve the overall exposure Use the command systemd-analyze security to analyze the security settings of a &systemd; service. For example: @@ -126,17 +126,17 @@ NAME DESCRIPTION EXPOSURE pscap tool from the libcap-ng-utils package. - + - The ~ prefix inverts the meaning of the option—instead of - listing all capabilities that the service retains, you may list the ones it does not + The ~ prefix inverts the meaning of the option—. Instead of + listing all capabilities that the service retains, you can list the ones it does not retain: ... [Service] CapabilityBoundingSet=~CAP_SYS_PTRACE ... - + From 08909565a5a38142ad5a8433fd319cc81da2319e Mon Sep 17 00:00:00 2001 From: Amrita Date: Tue, 10 Dec 2024 16:22:07 +0530 Subject: [PATCH 5/6] review feedback-2 --- tasks/systemd-example-secure-service.xml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tasks/systemd-example-secure-service.xml b/tasks/systemd-example-secure-service.xml index 97e50a37e..1663e7415 100644 --- a/tasks/systemd-example-secure-service.xml +++ b/tasks/systemd-example-secure-service.xml @@ -121,9 +121,10 @@ NAME DESCRIPTION EXPOSURE any other capabilities, not even via setuid binaries. + The <command>pscap</command> command tool - To easily identify which processes on your system retain which capabilities, use the - pscap tool from the libcap-ng-utils package. + To easily identify which processes on your system retain which capabilities, use the + pscap command tool from the libcap-ng-utils package. From eb4b365baf9895c5a4bdf2909c66f845ae1bfe75 Mon Sep 17 00:00:00 2001 From: Amrita Date: Wed, 11 Dec 2024 14:46:08 +0530 Subject: [PATCH 6/6] metadata and review --- DC-systemd-securing | 10 ++++++---- articles/systemd-securing.asm.xml | 2 +- tasks/systemd-example-secure-service.xml | 4 ++-- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/DC-systemd-securing b/DC-systemd-securing index 1e0595555..f7aa7a79a 100644 --- a/DC-systemd-securing +++ b/DC-systemd-securing @@ -4,9 +4,11 @@ SRC_DIR="articles" IMG_SRC_DIR="images" PROFCONDITION="suse-product" -PROFOS="sles" -#PROFCONDITION="suse-product;beta" -#PROFCONDITION="community-project" - +## Profiling +PROFOS="PRODUCT" +PROFCONDITION="PRODUCTNUMBER" +STRUCTID="STRUCTURE-ID" +PROFARCH="x86_64;zseries;power;aarch64" +DOCBOOK5_RNG_URI="urn:x-suse:rng:v2:geekodoc-flat" STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2022-ns" FALLBACK_STYLEROOT="/usr/share/xml/docbook/stylesheet/suse-ns" diff --git a/articles/systemd-securing.asm.xml b/articles/systemd-securing.asm.xml index c8aeef7f8..1c091e09a 100644 --- a/articles/systemd-securing.asm.xml +++ b/articles/systemd-securing.asm.xml @@ -73,7 +73,7 @@ &power;How to improve the overall exposure - &productname; + &sles; Securing &systemd; services Securing &systemd; services diff --git a/tasks/systemd-example-secure-service.xml b/tasks/systemd-example-secure-service.xml index 1663e7415..6935d40f8 100644 --- a/tasks/systemd-example-secure-service.xml +++ b/tasks/systemd-example-secure-service.xml @@ -16,8 +16,8 @@ - Use &systemd; to secure and strengthen services using specific directives and verify the same. - Use the security option to analyze the security and the sandboxing settings of one or more specified services. + Use the systemd-analyze security command to analyze the security settings of a &systemd; service. + The security option analyzes the security and the sandboxing settings of one or more specified services.