Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://hails.org/users/hailey/statuses/115772427915685171">Hailey (hailey@hails.org)'s status on Wednesday, 24-Dec-2025 12:31:28 JST</a><a href="https://hails.org/@hailey" title="hailey@hails.org"><img src="https://gnusocial.jp/avatar/103362-48-20240818151033.webp" width="48" height="48" alt="Hailey" style="position: absolute; left: 0; top: 0;">Hailey</a><div><a href="https://hails.org/@hailey/115772373049372624" rel="in-reply-to">in reply to</a></div></section><article><p>If you want to know more, here's some good places to start in the systemd docs:</p><p>General hardening: <a href="https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#Sandboxing" rel="nofollow noreferrer">https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#Sandboxing</a></p><p>Network filtering: <a href="https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html" rel="nofollow noreferrer">https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html</a></p><p>+ honourable mention for SSH, a tool I haven't used but looks interesting, which can automatically generate hardening settings for you by observing what your service actually does at runtime: <a href="https://github.com/desbma/shh" rel="nofollow noreferrer">https://github.com/desbma/shh</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/5985641#notice-11777489">In conversation</a><time datetime="2025-12-24T12:31:28+09:00" title="Wednesday, 24-Dec-2025 12:31:28 JST">about 3 months ago</time> <span>from <span><a href="https://hails.org/@hailey/115772427915685171" rel="external" title="Sent from hails.org via ActivityPub">hails.org</a></span></span><a href="https://hails.org/@hailey/115772427915685171">permalink</a><h4>Attachments</h4><ol><li><article><header><div>No result found on File_thumbnail lookup.</div><h5><a href="https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#SandboxingNetwork">systemd.exec</a></h5><div></div></header><div></div><footer></footer></article></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/5597019">Untitled attachment</a></label><br></li><li><article><header><div>Domain not in remote thumbnail source whitelist: repository-images.githubusercontent.com</div><h5><a href="https://github.com/desbma/shh">GitHub - desbma/shh: Systemd Hardening Helper - Automatic systemd service hardening guided by strace profiling</a></h5><div></div></header><div>Systemd Hardening Helper - Automatic systemd service hardening guided by strace profiling - desbma/shh</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Hailey (hailey@hails.org)'s status on Wednesday, 24-Dec-2025 12:31:28 JST Hailey
in reply to
If you want to know more, here's some good places to start in the systemd docs:
General hardening: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#Sandboxing
Network filtering: https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html
+ honourable mention for SSH, a tool I haven't used but looks interesting, which can automatically generate hardening settings for you by observing what your service actually does at runtime: https://github.com/desbma/shh
In conversationabout 3 months ago from hails.orgpermalink
Attachments
1. No result found on File_thumbnail lookup.
  systemd.exec
2. Untitled attachment
3. Domain not in remote thumbnail source whitelist: repository-images.githubusercontent.com
  GitHub - desbma/shh: Systemd Hardening Helper - Automatic systemd service hardening guided by strace profiling
  Systemd Hardening Helper - Automatic systemd service hardening guided by strace profiling - desbma/shh

Public

Embed Notice

HTML Code

Corresponding Notice