root@vyos-lns-1:/etc/systemd/system/vyos-telegraf.service.d# systemd-analyze --no-pager security vyos-telegraf.service NAME DESCRIPTION EXPOSURE ✗ PrivateNetwork= Service has access to the host's network 0.5 ✓ User=/DynamicUser= Service runs under a static non-root user identity ✓ CapabilityBoundingSet=~CAP_SET(UID|GID|PCAP) Service cannot change UID/GID identities/capabiliti… ✗ CapabilityBoundingSet=~CAP_SYS_ADMIN Service has administrator privileges 0.3 ✓ CapabilityBoundingSet=~CAP_SYS_PTRACE Service has no ptrace() debugging abilities ✗ RestrictAddressFamilies=~AF_(INET|INET6) Service may allocate Internet sockets 0.3 ✗ RestrictNamespaces=~CLONE_NEWUSER Service may create user namespaces 0.3 ✗ RestrictAddressFamilies=~… Service may allocate exotic sockets 0.3 ✗ CapabilityBoundingSet=~CAP_(CHOWN|FSETID|SETFCAP) Service may change file ownership/access mode/capab… 0.2 ✗ CapabilityBoundingSet=~CAP_(DAC_*|FOWNER|IPC_OWNER) Service may override UNIX file/IPC permission checks 0.2 ✗ CapabilityBoundingSet=~CAP_NET_ADMIN Service has network configuration privileges 0.2 ✓ CapabilityBoundingSet=~CAP_SYS_MODULE Service cannot load kernel modules ✓ CapabilityBoundingSet=~CAP_SYS_RAWIO Service has no raw I/O access ✓ CapabilityBoundingSet=~CAP_SYS_TIME Service processes cannot change the system clock ✗ DeviceAllow= Service has no device ACL 0.2 ✗ IPAddressDeny= Service does not define an IP address allow list 0.2 ✓ KeyringMode= Service doesn't share key material with other servi… ✗ NoNewPrivileges= Service processes may acquire new privileges 0.2 ✓ NotifyAccess= Service child processes cannot alter service state ✗ PrivateDevices= Service potentially has access to hardware devices 0.2 ✗ PrivateMounts= Service may install system mounts 0.2 ✗ PrivateTmp= Service has access to other software's temporary fi… 0.2 ✗ PrivateUsers= Service has access to other users 0.2 ✗ ProtectClock= Service may write to the hardware clock or system c… 0.2 ✗ ProtectControlGroups= Service may modify the control group file system 0.2 ✗ ProtectHome= Service has full access to home directories 0.2 ✗ ProtectKernelLogs= Service may read from or write to the kernel log ri… 0.2 ✗ ProtectKernelModules= Service may load or read kernel modules 0.2 ✗ ProtectKernelTunables= Service may alter kernel tunables 0.2 ✗ ProtectProc= Service has full access to process tree (/proc hide… 0.2 ✗ ProtectSystem= Service has full access to the OS file hierarchy 0.2 ✗ RestrictAddressFamilies=~AF_PACKET Service may allocate packet sockets 0.2 ✗ RestrictSUIDSGID= Service may create SUID/SGID files 0.2 ✗ SystemCallArchitectures= Service may execute system calls with all ABIs 0.2 ✗ SystemCallFilter=~@clock Service does not filter system calls 0.2 ✗ SystemCallFilter=~@debug Service does not filter system calls 0.2 ✗ SystemCallFilter=~@module Service does not filter system calls 0.2 ✗ SystemCallFilter=~@mount Service does not filter system calls 0.2 ✗ SystemCallFilter=~@raw-io Service does not filter system calls 0.2 ✗ SystemCallFilter=~@reboot Service does not filter system calls 0.2 ✗ SystemCallFilter=~@swap Service does not filter system calls 0.2 ✗ SystemCallFilter=~@privileged Service does not filter system calls 0.2 ✗ SystemCallFilter=~@resources Service does not filter system calls 0.2 ✓ AmbientCapabilities= Service process does not receive ambient capabiliti… ✓ CapabilityBoundingSet=~CAP_AUDIT_* Service has no audit subsystem access ✓ CapabilityBoundingSet=~CAP_KILL Service cannot send UNIX signals to arbitrary proce… ✓ CapabilityBoundingSet=~CAP_MKNOD Service cannot create device nodes ✗ CapabilityBoundingSet=~CAP_NET_(BIND_SERVICE|BROAD… Service has elevated networking privileges 0.1 ✓ CapabilityBoundingSet=~CAP_SYSLOG Service has no access to kernel logging ✓ CapabilityBoundingSet=~CAP_SYS_(NICE|RESOURCE) Service has no privileges to change resource use pa… ✗ RestrictNamespaces=~CLONE_NEWCGROUP Service may create cgroup namespaces 0.1 ✗ RestrictNamespaces=~CLONE_NEWIPC Service may create IPC namespaces 0.1 ✗ RestrictNamespaces=~CLONE_NEWNET Service may create network namespaces 0.1 ✗ RestrictNamespaces=~CLONE_NEWNS Service may create file system namespaces 0.1 ✗ RestrictNamespaces=~CLONE_NEWPID Service may create process namespaces 0.1 ✗ RestrictRealtime= Service may acquire realtime scheduling 0.1 ✗ SystemCallFilter=~@cpu-emulation Service does not filter system calls 0.1 ✗ SystemCallFilter=~@obsolete Service does not filter system calls 0.1 ✗ RestrictAddressFamilies=~AF_NETLINK Service may allocate netlink sockets 0.1 ✗ RootDirectory=/RootImage= Service runs within the host's root directory 0.1 ✓ SupplementaryGroups= Service has no supplementary groups ✓ CapabilityBoundingSet=~CAP_MAC_* Service cannot adjust SMACK MAC ✓ CapabilityBoundingSet=~CAP_SYS_BOOT Service cannot issue reboot() ✓ Delegate= Service does not maintain its own delegated control… ✗ LockPersonality= Service may change ABI personality 0.1 ✗ MemoryDenyWriteExecute= Service may create writable executable memory mappi… 0.1 ✗ RemoveIPC= Service user may leave SysV IPC objects around 0.1 ✗ RestrictNamespaces=~CLONE_NEWUTS Service may create hostname namespaces 0.1 ✗ UMask= Files created by service are world-readable by defa… 0.1 ✓ CapabilityBoundingSet=~CAP_LINUX_IMMUTABLE Service cannot mark files immutable ✓ CapabilityBoundingSet=~CAP_IPC_LOCK Service cannot lock memory into RAM ✓ CapabilityBoundingSet=~CAP_SYS_CHROOT Service cannot issue chroot() ✗ ProtectHostname= Service may change system host/domainname 0.1 ✓ CapabilityBoundingSet=~CAP_BLOCK_SUSPEND Service cannot establish wake locks ✗ CapabilityBoundingSet=~CAP_LEASE Service may create file leases 0.1 ✓ CapabilityBoundingSet=~CAP_SYS_PACCT Service cannot use acct() ✓ CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG Service cannot issue vhangup() ✓ CapabilityBoundingSet=~CAP_WAKE_ALARM Service cannot program timers that wake up the syst… ✗ RestrictAddressFamilies=~AF_UNIX Service may allocate local sockets 0.1 ✗ ProcSubset= Service has full access to non-process /proc files … 0.1 → Overall exposure level for vyos-telegraf.service: 7.6 EXPOSED 🙁 root@vyos-lns-1:/etc/systemd/system/vyos-telegraf.service.d#