3 ms·
"The exposure score is entirely based on a service’s utilization of security features provided by systemd. It doesn’t consider security features built-in to the
by shrubble 7y ago
"The exposure score is entirely based on a service’s utilization of security features provided by systemd. It doesn’t consider security features built-in to the program or enforced by access control policies like Security-Enhanced Linux (SELinux) or AppArmor. Nor does the score in any way evaluate the risk factors of a program or its configuration."
So an SSH config with PermitRootLogin Yes with passwords allowed, with an unpatched vulnerability, but that uses systemd, will be marked as safer than a locked down SSH config that is kept updated but which doesn't use any systemd features.
Is that an accurate statement?
- throwawaymanbot 7y agoIts not. Exactly right. and I guess well have to gloss over all the other reported systemd introduced vulns shall we? Again its just systemd lock-in.
- codys 7y agoThe article is about a tool to examine the declarative service configuration provided by systemd. It does not examine services for "unpatched vulnerabilities". Nor does it examine ssh configuration options. It only examines declared sand boxing config in systemd unit files. If you want a vulnerability scanner and generalize config analysis tool, this isn't it.