ngcp-rate-o-mat service state BEFORE this change:
| $ sudo systemd-analyze security ngcp-rate-o-mat | tail -1
| → Overall exposure level for ngcp-rate-o-mat.service: 9.6 UNSAFE 😨
ngcp-rate-o-mat service state AFTER this change:
| $ sudo systemd-analyze security ngcp-rate-o-mat | grep -v '✓'
| NAME DESCRIPTION EXPOSURE
| ✗ PrivateNetwork= Service has access to the host's network 0.5
| ✗ User=/DynamicUser= Service runs as root user 0.4
| ✗ RestrictAddressFamilies=~AF_(INET|INET6) Service may allocate Internet sockets 0.3
| ✗ DeviceAllow= Service has a device ACL with some special devices 0.1
| ✗ IPAddressDeny= Service does not define an IP address allow list 0.2
| ✗ ProtectClock= Service may write to the hardware clock or system clock 0.2
| ✗ ProtectKernelLogs= Service may read from or write to the kernel log ring buffer 0.2
| ✗ ProtectProc= Service has full access to process tree (/proc hidepid=) 0.2
| ✗ RestrictSUIDSGID= Service may create SUID/SGID files 0.2
| ✗ RootDirectory=/RootImage= Service runs within the host's root directory 0.1
| SupplementaryGroups= Service runs as root, option does not matter
| RemoveIPC= Service runs as root, option does not apply
| ✗ ProtectHostname= Service may change system host/domainname 0.1
| ✗ RestrictAddressFamilies=~AF_UNIX Service may allocate local sockets 0.1
| ✗ ProcSubset= Service has full access to non-process /proc files (/proc subset=) 0.1
|
| → Overall exposure level for ngcp-rate-o-mat.service: 2.1 OK 🙂
NOTE: state with systemd v247.3-5 on bullseye
Change-Id: Iace478d9c5762cd641a333c0ea7d1b77b919a10d
Is service B "Requires" service A to be started before B
and B does NOT require B restart on A restart, B should use "Wants=A".
Also using real service name mariadb.service instead of the alias one.
Change-Id: Icdaa206091cbc275cca2393f7105e9a5721eb2b3
We should use for now the mysql.service, which is the one autogenerated
from our init script, that has special handling for our setup. Using the
mariadb.service right now makes this service fail.
Change-Id: I80b7a124094bc017729266e60e3a96a309e2cc1e
Sipwise Jenkins Builder
Michael Prokop
Guillem Jover
Rene Krenn
Alexander Lutay
Manuel Montecelo