Myzel394

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

Trailing asterisks indicate books I've finished reading

Libre:

	<?xml version="1.0" encoding="UTF-8" standalone="no"?>
	<root testAttr="testValue">
	<result>
	<child>data1</child>
	<child>A1343358848.646</child>
	<child>
	<internal>
	<data>one</data>
	<data>two</data>
	<unique>Z1343358848.646</unique>

	# This is the sshd server system-wide configuration file. See
	# sshd_config(5) for more information.

	# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

	# The strategy used for options in the default sshd_config shipped with
	# OpenSSH is to specify options with their default value where
	# possible, but leave them commented. Uncommented options change a
	# default value.

	# Reliable persistent SSH-Tunnel via systemd (not autossh)
	# https://gist.github.com/guettli/31242c61f00e365bbf5ed08d09cdc006#file-ssh-tunnel-service

	[Unit]
	Description=Tunnel for %i
	After=network.target

	[Service]
	User=tunnel
	ExecStart=/usr/bin/ssh -o "ExitOnForwardFailure yes" -o "ServerAliveInterval 60" -N tunnel@%i

	/*
	* In embedded systems, the C programming language is most often the language of choice. For more intensive
	* elements in the system, assembly can be used. Embedded C is distinct from typical C programming in its
	* requirements for efficiency, its limited resources, and its unique hardware problems which are much less common in
	* the majority of C programs. Even still, the language itself is the same, so check out K&R's The C Programming
	* Language and other reference books.
	*
	* Some of the problems central to embedded systems programming:
	* - Memory management
	* - Register access and manipulation