Skip to content

Ubuntu Noble warden-specific systemd hardening #506

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mike-jc wants to merge 6 commits into from
Closed

Ubuntu Noble warden-specific systemd hardening #506

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
22fe474
New stage (warden-specific) to clean up all custom/optional systemd s…
mike-jc Apr 1, 2026
0319bcc
Fixes
mike-jc Apr 1, 2026
216b4a6
Move from allowlist to masklist of services
mike-jc Apr 2, 2026
5b043ec
Move from allowlist to masklist of services; output
mike-jc Apr 2, 2026
d3f1cd9
Fix
mike-jc Apr 2, 2026
f5d310b
Fix
mike-jc Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions stemcell_builder/stages/base_warden/apply.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,5 +73,15 @@ for service in "${rosetta_services[@]}"; do
cp "$assets_dir/rosetta-compat.conf" "$chroot/etc/systemd/system/${service}.service.d/rosetta-compat.conf"
done

# Mask systemd-binfmt.service which fails under Rosetta emulation
run_in_chroot "$chroot" "systemctl mask systemd-binfmt.service"
# Some services are not compatible with running in a container,
# so we mask them to prevent systemd from trying to start them and fail.
masked_services=(
systemd-binfmt
)
masked_service_units="${masked_services[*]/%/.service}"

echo "base_warden: masking service units: ${masked_service_units}"
run_in_chroot "$chroot" "systemctl mask ${masked_service_units}"

echo "base_warden: service units kept (not masked):"
run_in_chroot "$chroot" "systemctl list-unit-files --state=enabled,static --type=service --no-legend | awk '{print \$1}'"