Re: systemd-analyze security as a release goal

2023-07-17 Thread Trent W. Buck
Matthew Garrett writes: > On Thu, Jul 13, 2023 at 08:03:39PM +0200, Timo Röhling wrote: > >> qemu is basically an interpreter for foreign machine code. If your >> threat model allows access to qemu-user-static for an attacker, they >> can run pretty much any binary is if it were native, and the

Re: systemd-analyze security as a release goal

2023-07-04 Thread Trent W. Buck
Marco d'Itri writes: > On Jul 04, "Trent W. Buck" wrote: > >> * If it runs its own process manager (e.g. postfix's "master"), >> don't bother trying to harden it. > I disagree. It may not be possible to use NoNewPrivileges, but at least > file system hardening is usually trivial to

Re: systemd-analyze security as a release goal

2023-07-04 Thread Marco d'Itri
On Jul 04, "Trent W. Buck" wrote: > * If it runs its own process manager (e.g. postfix's "master"), > don't bother trying to harden it. I disagree. It may not be possible to use NoNewPrivileges, but at least file system hardening is usually trivial to enable for most daemons. > * If it

Re: systemd-analyze security as a release goal

2023-07-03 Thread Trent W. Buck
RL writes: > Russell Coker writes: > >> https://wiki.debian.org/ReleaseGoals/SystemdAnalyzeSecurity >> >> I think we should make it a release goal to have as many daemons as >> possible running with systemd security features to aim for a low score >> from "systmd-analyze security". > > > This