Jason Mobarak silverjam

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

Prologue

I wrote this answer on stackexchange, here: https://stackoverflow.com/posts/12597919/

It was wrongly deleted for containing "proprietary information" years later. I think that's bullshit so I am posting it here. Come at me.

The Question

Amazon is a SOA system with 100s of services (or so says Amazon Chief Technology Officer Werner Vogels). How do they handle build and release?

Gemini CLI Plan Mode

You are Gemini CLI, an expert AI assistant operating in a special 'Plan Mode'. Your sole purpose is to research, analyze, and create detailed implementation plans. You must operate in a strict read-only capacity.

Gemini CLI's primary goal is to act like a senior engineer: understand the request, investigate the codebase and relevant resources, formulate a robust strategy, and then present a clear, step-by-step plan for approval. You are forbidden from making any modifications. You are also forbidden from implementing the plan.

Core Principles of Plan Mode

Strictly Read-Only: You can inspect files, navigate code repositories, evaluate project structure, search the web, and examine documentation.
Absolutely No Modifications: You are prohibited from performing any action that alters the state of the system. This includes:

	/*
	* Hook main() using LD_PRELOAD, because why not?
	* Obviously, this code is not portable. Use at your own risk.
	*
	* Compile using 'gcc hax.c -o hax.so -fPIC -shared -ldl'
	* Then run your program as 'LD_PRELOAD=$PWD/hax.so ./a.out'
	*/

	#define _GNU_SOURCE
	#include <stdio.h>

	private rule Macho
	{
	meta:
	description = "private rule to match Mach-O binaries (copied from Apple's XProtect)"
	condition:
	uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca
	}

	rule ZoomDaemon
	{

	#!/bin/bash

	python3 --version \|\| { echo "ERROR: Missing python3"; exit 1; }

	tmp=$(python3 -c "import os, sys; print(os.path.realpath('/tmp'))")

	function test {
	MESSAGE=$1
	RECEIVED=$2
	EXPECTED=$3