For Teachers · Back to the Module · Print with your browser's Print command.

P11 Teacher Answer Key: Service Hardening With systemd

Teacher Answer Key (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P1

Learning Objectives

• [ ] Read a systemd unit file and its drop-ins and know which settings win.
• [ ] Explain why a service's user, program location and unit file permissions decide what an attacker gains.
• [ ] Apply basic sandboxing settings and keep secrets out of unit files.

Key Terms

Write each definition in your own words.

• Service Unit: A systemd configuration file that describes how to start, stop and run a background service, including its program and user account.
• Sandboxing: Running a program with restricted access to files, devices and privileges, so a compromise of it does less damage.
• Least Privilege: Giving every account and process only the access it needs, nothing more.
• Privilege Escalation: Gaining higher privileges than intended, for example turning a normal user account into root.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-SYSD- --out p11 and list, for each vulnerable unit, the line you would add or change.
2. Compare the shop-api.service unit in the vulnerable and hardened labs (internal/lab/fixtures_stacks.go) setting by setting.
3. On a test machine: systemd-analyze security and pick the service with the worst score; add NoNewPrivileges=yes with systemctl edit and re-run.

Self-Check Questions

1. A system service unit has no User= line. Which account runs the service?

• [ ] a) nobody
• [x] b) root
• [ ] c) the user who installed it
• [ ] d) a dynamic user
• Answer: b. Without User= or DynamicUser=, systemd runs a system service as root.

1. Why is a world-writable unit file dangerous?

• [ ] a) It wastes disk space
• [x] b) Any user can change ExecStart= and have their program run as root
• [ ] c) systemd refuses to start it
• [ ] d) It slows down boot
• Answer: b. Whoever controls the unit controls what root runs at the next restart.

1. Where should a service's database password go?

• [ ] a) Environment= in the unit file
• [x] b) A root-only EnvironmentFile= or a systemd credential
• [ ] c) The service's Description=
• [ ] d) A comment in the unit file
• Answer: b. Unit files and Environment= values are visible to every local user.

1. What does ProtectSystem=strict do?

• [x] a) Mounts the operating system read-only for the service
• [ ] b) Blocks network access
• [ ] c) Gives the service its own /tmp
• [ ] d) Runs the service as nobody
• Answer: a. The service can then write only to the paths listed in ReadWritePaths=. Its own /tmp is PrivateTmp=.

1. A unit file and a drop-in in <name>.service.d/ set the same option differently. Which value normally applies?

• [ ] a) The unit file's
• [x] b) The drop-in's, because drop-ins are applied after the unit file
• [ ] c) Whichever file is larger
• [ ] d) Neither, because systemd refuses to start the unit
• Answer: b. systemd reads the unit file, then applies drop-ins in order, so a drop-in overrides it.

1. Which command scores how exposed a unit is?

• [ ] a) systemctl status
• [x] b) systemd-analyze security
• [ ] c) journalctl -u
• [ ] d) ss -tlnp
• Answer: b. systemd-analyze security rates a unit's exposure and suggests sandboxing options.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• systemd.exec(5): https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html
• systemd, System and Service Credentials: https://systemd.io/CREDENTIALS/
• MITRE ATT&CK T1543.002, Systemd Service: https://attack.mitre.org/techniques/T1543/002/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.