shh

And it's a proper way to use computer nowadays. Apart from high-overhead solutions like VMs and containers, there are seamless and maintenance-free solutions (after the initial setup): - systemd service hardening [0] [1] pretty powerful, but it's a blacklist approach - whack-a-mole - AppArmor [2] Whitelist, proactive approach. Contrary to SElinux, it's not a programming language, and could be grasped pretty quickly. I made a tool to easily convert AA logs into usable rules. [3] [0] https://github.com/alegrey91/systemd-service-hardening [1] https://github.com/desbma/shh [2] https://presentations.nordisch.org/apparmor/ [3] https://github.com/nobody43/apparmor-suggest

TIL about systrack, which extracts syscalls from vmlinuz kernel images. https://github.com/mebeim/systrack /? tool to dump a list of all syscalls in a binary on Linux, like nm objdump, transitively searches dynamically linked https://www.google.com/search?q=tool+to+dump+a+list+of+all+s... : - list-syscalls.rb "A script to statically list syscalls used by a given binary" https://gist.github.com/koute/166f82bfee5e27324077891008fca6... - "B-Side: Binary-Level Static System Call Identification" (2024) x86-64 https://arxiv.org/abs/2410.18053v1 - Systemd has SyscallFilter= From https://news.ycombinator.com/item?id=44947469 : > desbma/shh generates SyscallFilter and other systemd unit rules from straces similar to how audit2allow generates SELinux policies by grepping for AVC denials in permissive mode desbma/shh: https://github.com/desbma/shh

Because they/we don't have sufficient integration tests to verify that the core system services are working after tightening down each parameter. From https://news.ycombinator.com/item?id=29995566 : > Which distro has the best out-of-the-box output for?: systemd-analyze security desbma/shh generates SyscallFilter and other systems unit rules from straces similar to how audit2allow generates SELinux policies by grepping for AVC denials in permissive mode (given kernel parameters `enforcing=0 selinux=1`), but should strace be installed in production?: desbma/shh: https://github.com/desbma/shh

Automatic systemd service hardening guided by strace profiling https://github.com/desbma/shh