systemdlint

Systemd Unitfile Linter

Usage

usage: systemdlint [-h] [--nodropins] [--rootpath ROOTPATH] [--sversion SVERSION] [--output OUTPUT] [--norootfs] files [files ...]

Systemd Unitfile Linter

positional arguments:
  files                Files to parse

optional arguments:
  -h, --help           show this help message and exit
  --nodropins          Ignore Drop-Ins for parsing
  --rootpath ROOTPATH  Root path
  --sversion SVERSION  Version of Systemd to be used
  --output OUTPUT      Where to flush the findings (default: stderr)
  --norootfs           Run only unit file related tests

Why should I use it?

Surely you can use systemd-analyze verify [unitname] to validate your units - no problem and it's the recommended way if you writing units for the system you are currently running on. Unfortunately systemd doesn't offer a validation which doesn't require an already running version of systemd you want to validate against.

This tool was initially created to check units in cross-compiled embedded images at build time, where you can't run a copy of systemd (as it's cross-compiled). As a consequence it doesn't use any systemd code and might interpret some settings differently than systemd itself - as with every linter take the outcomes as a basis for further analysis. Also keep in mind, that systemd does create a larger stack of runtime files, which are not taken into account by the tool - same for kernel related information like /dev, /sys or /proc entries.

Furthermore the tool gives you advice how your unit files could be hardened.

Installation

PyPi

simply run

pip3 install systemdlint

From source

• Install the needed requirements by running pip3 install systemdunitparser anytree
• git clone this repository
• cd to <clone folder>/systemdlint
• run sudo ./build.sh

Output

The tool will return

{file}:{line}:{severity} [{id}] - {message}

example:

/lib/systemd/system/console-shell.service:18:info [NoFailureCheck] - Return-code check is disabled. Errors are not reported
/lib/systemd/system/plymouth-halt.service:11:info [NoFailureCheck] - Return-code check is disabled. Errors are not reported
/lib/systemd/system/systemd-ask-password-console.service:12:warning [ReferencedUnitNotFound] - The Unit 'systemd-vconsole-setup.service' referenced was not found in filesystem
/lib/systemd/system/basic.target:19:warning [ReferencedUnitNotFound] - The Unit 'tmp.mount' referenced was not found in filesystem

The output format is configurable with --messageformat, for example:

systemdlint --messageformat='{path}:{line}:{severity}:{msg}' ...

Detectable Errors

• ConflictingOptions - The set option somehow is in conflict with another unit
• ErrorCyclicDependency - Unit creates a cyclic dependency
• ExecNotFound - The referenced executable was not found on system
• FullPrivileges - An executable is run with full privileges
• InvalidNumericBase - A numeric value doesn't match because it needs to be a multiple of X
• InvalidSetting - The option doesn't match the section
• InvalidValue - An invalid value is set
• MandatoryOptionMissing - A mandatory option was missing in the file
• Multiplicity - The option is not valid for the given amount of options in this context
• NoExecutable - The referenced executable is NOT executable
• NoFailureCheck - An executable is run without checking for failures
• OptionDeprecated - The used option is not available anymore in this version
• OptionTooNew - The used option will be available in a later version than used
• ReferencedUnitNotFound - The unit referenced was not found in system
• Security.@clock - SystemCallFilter shouldn't contain @clock
• Security.@cpu-emulation - SystemCallFilter shouldn't contain @cpu-emulation
• Security.@debug - SystemCallFilter shouldn't contain @debug
• Security.@module - SystemCallFilter shouldn't contain @module
• Security.@mount - SystemCallFilter shouldn't contain @mount
• Security.@obsolete - SystemCallFilter shouldn't contain @obsolete
• Security.@privileged - SystemCallFilter shouldn't contain @privileged
• Security.@raw-io - SystemCallFilter shouldn't contain @raw-io
• Security.@reboot - SystemCallFilter shouldn't contain @reboot
• Security.@resources - SystemCallFilter shouldn't contain @resources
• Security.@swap - SystemCallFilter shouldn't contain @swap
• Security.AF_INET - RestrictAddressFamilies shouldn't contain AF_INET
• Security.AF_INET6 - RestrictAddressFamilies shouldn't contain AF_INET6
• Security.AF_NETLINK - RestrictAddressFamilies shouldn't contain AF_NETLINK
• Security.AF_PACKET - RestrictAddressFamilies shouldn't contain AF_PACKET
• Security.AF_UNIX - RestrictAddressFamilies shouldn't contain AF_UNIX
• Security.CAP_AUDIT_CONTROL - CapabilityBoundingSet shouldn't contain CAP_AUDIT_CONTROL
• Security.CAP_AUDIT_READ - CapabilityBoundingSet shouldn't contain CAP_AUDIT_READ
• Security.CAP_AUDIT_WRITE - CapabilityBoundingSet shouldn't contain CAP_AUDIT_WRITE
• Security.CAP_BLOCK_SUSPEND - CapabilityBoundingSet shouldn't contain CAP_BLOCK_SUSPEND
• Security.CAP_CHOWN - CapabilityBoundingSet shouldn't contain CAP_CHOWN
• Security.CAP_DAC_OVERRIDE - CapabilityBoundingSet shouldn't contain CAP_DAC_OVERRIDE
• Security.CAP_DAC_READ_SEARCH - CapabilityBoundingSet shouldn't contain CAP_DAC_READ_SEARCH
• Security.CAP_FOWNER - CapabilityBoundingSet shouldn't contain CAP_FOWNER
• Security.CAP_FSETID - CapabilityBoundingSet shouldn't contain CAP_FSETID
• Security.CAP_IPC_LOCK - CapabilityBoundingSet shouldn't contain CAP_IPC_LOCK
• Security.CAP_IPC_OWNER - CapabilityBoundingSet shouldn't contain CAP_IPC_OWNER
• Security.CAP_KILL - CapabilityBoundingSet shouldn't contain CAP_KILL
• Security.CAP_LEASE - CapabilityBoundingSet shouldn't contain CAP_LEASE
• Security.CAP_LINUX_IMMUTABLE - CapabilityBoundingSet shouldn't contain CAP_LINUX_IMMUTABLE
• Security.CAP_MAC_ADMIN - CapabilityBoundingSet shouldn't contain CAP_MAC_ADMIN
• Security.CAP_MAC_OVERRIDE - CapabilityBoundingSet shouldn't contain CAP_MAC_OVERRIDE
• Security.CAP_MKNOD - CapabilityBoundingSet shouldn't contain CAP_MKNOD
• Security.CAP_NET_ADMIN - CapabilityBoundingSet shouldn't contain CAP_NET_ADMIN
• Security.CAP_NET_BIND_SERVICE - CapabilityBoundingSet shouldn't contain CAP_NET_BIND_SERVICE
• Security.CAP_NET_BROADCAST - CapabilityBoundingSet shouldn't contain CAP_NET_BROADCAST
• Security.CAP_NET_RAW - CapabilityBoundingSet shouldn't contain CAP_NET_RAW
• Security.CAP_RAWIO - CapabilityBoundingSet shouldn't contain CAP_RAWIO
• Security.CAP_SETFCAP - CapabilityBoundingSet shouldn't contain CAP_SETFCAP
• Security.CAP_SETGID - CapabilityBoundingSet shouldn't contain CAP_SETGID
• Security.CAP_SETPCAP - CapabilityBoundingSet shouldn't contain CAP_SETPCAP
• Security.CAP_SETUID - CapabilityBoundingSet shouldn't contain CAP_SETUID
• Security.CAP_SYS_ADMIN - CapabilityBoundingSet shouldn't contain CAP_SYS_ADMIN
• Security.CAP_SYS_BOOT - CapabilityBoundingSet shouldn't contain CAP_SYS_BOOT
• Security.CAP_SYS_CHROOT - CapabilityBoundingSet shouldn't contain CAP_SYS_CHROOT
• Security.CAP_SYS_MODULE - CapabilityBoundingSet shouldn't contain CAP_SYS_MODULE
• Security.CAP_SYS_NICE - CapabilityBoundingSet shouldn't contain CAP_SYS_NICE
• Security.CAP_SYS_PACCT - CapabilityBoundingSet shouldn't contain CAP_SYS_PACCT
• Security.CAP_SYS_PTRACE - CapabilityBoundingSet shouldn't contain CAP_SYS_PTRACE
• Security.CAP_SYS_RESOURCE - CapabilityBoundingSet shouldn't contain CAP_SYS_RESOURCE
• Security.CAP_SYS_TIME - CapabilityBoundingSet shouldn't contain CAP_SYS_TIME
• Security.CAP_SYS_TTY_CONFIG - CapabilityBoundingSet shouldn't contain CAP_SYS_TTY_CONFIG
• Security.CAP_SYSLOG - CapabilityBoundingSet shouldn't contain CAP_SYSLOG
• Security.CAP_WAKE_ALARM - CapabilityBoundingSet shouldn't contain CAP_WAKE_ALARM
• Security.CLONE_NEWCGROUP - RestrictNamespaces shouldn't contain CLONE_NEWCGROUP
• Security.CLONE_NEWIPC - RestrictNamespaces shouldn't contain CLONE_NEWIPC
• Security.CLONE_NEWNET - RestrictNamespaces shouldn't contain CLONE_NEWNET
• Security.CLONE_NEWNS - RestrictNamespaces shouldn't contain CLONE_NEWNS
• Security.CLONE_NEWPID - RestrictNamespaces shouldn't contain CLONE_NEWPID
• Security.CLONE_NEWUSER - RestrictNamespaces shouldn't contain CLONE_NEWUSER
• Security.CLONE_NEWUTS - RestrictNamespaces shouldn't contain CLONE_NEWUTS
• Security.Delegate - Delegate shall be set to yes
• Security.DevicePolicy - DevicePolicy should be set to closed
• Security.IPAddressDenyNA - IPAddressDeny shall be set
• Security.KeyringModeNA - KeyringMode shall be set
• Security.KeyringModeNPriv - KeyringMode shall be set to private
• Security.LockPersonality - LockPersonality shall be set to yes
• Security.MemoryDenyWriteExecute - MemoryDenyWriteExecute shall be set to yes
• Security.NoNewPrivileges - NoNewPrivileges shall be set to yes
• Security.NotifyAccess - NotifyAccess=all should be avoided
• Security.NoUser - No user is set for the service
• Security.PrivateDevices - PrivateDevices shall be set to yes
• Security.PrivateMounts - PrivateMounts shall be set to yes
• Security.PrivateNetwork - PrivateNetwork shall be set to yes
• Security.PrivateTmp - PrivateTmp shall be set to yes
• Security.PrivateUsers - PrivateUsers shall be set to yes
• Security.ProtectClock - ProtectClock shall be set to yes
• Security.ProtectControlGroups - ProtectControlGroups shall be set to yes
• Security.ProtectHomeNA - ProtectHome shall be set
• Security.ProtectHomeOff - ProtectHome shall be set to yes
• Security.ProtectHostname - ProtectHostname shall be set to yes
• Security.ProtectKernelLogs - ProtectKernelLogs shall be set to yes
• Security.ProtectKernelModules - ProtectKernelModules shall be set to yes
• Security.ProtectKernelTunables - ProtectKernelTunables shall be set to yes
• Security.ProtectSystemNA - ProtectSystem shall be set
• Security.ProtectSystemNStrict - ProtectSystem shall be set to strict
• Security.RemoveIPC - RemoveIPC should be activated
• Security.RestrictRealtime - RestrictRealtime shall be set to yes
• Security.RestrictSUIDSGID - RestrictSUIDSGID shall be set to yes
• Security.RootDirectory - RootDirectory or RootImage shall be set to a non-root path
• Security.SupplementaryGroups - SupplementaryGroups shall be avoided
• Security.SystemCallArchitecturesMult - SystemCallArchitectures shouldn't be set for multiple archs
• Security.SystemCallArchitecturesNA - SystemCallArchitectures shall be set
• Security.UMaskGR - Files created by service are group-readbale
• Security.UMaskGW - Files created by service are group-writeable
• Security.UMaskOR - Files created by service are world-readbale
• Security.UMaskOW - Files created by service are world-writeable
• Security.UserNobody - User nobody is set for the service
• Security.UserRoot - User root is set for the service
• SettingRequires - The option requires another option to be set
• SettingRestricted - The option can't be set due to another option
• SyntaxError - The file is not parsable
• UnitSectionMissing - The Unit-section is missing in the file
• UnknownUnitType - The file extension of the file is not a known systemd one
• WrongFileMask - The file has a risky filemode set

vscode extension

Find the extension in the marketplace, or search for systemdlint-vscode