Ubuntu Jammy warden-specific systemd hardening

[mike-jc]

This is for Ubuntu Jammy stemcell.

These changes are related to issues:

• warden/boshlite: Missing SSH keys in /etc/ssh causing issues with ssh
• Necessary systemd services could be removed during hardening

Added a new stage base_systemd_clean to the warden_stages collection, which is applied during stemcell build, and removes all custom and optional systemd services, keeping only the necessary minimum set.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: mike-jc / name: Mike Yeromko (57fcccb, 5f9a841)

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 40799680-eb84-499c-9a50-2dc469f5d821

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mike-jc]

Closing this PR as we have decided not to proceed with the allow list approach in favor of the mask list approach, see the comment in PR 506.