rhi

Coordinated trade for connected markets
git clone https://radroots.dev/git/rhi.git
Log | Files | Refs | README | LICENSE

systemd_qualification.v1.json (3229B)

      1 {
      2   "$schema": "https://json-schema.org/draft/2020-12/schema",
      3   "schema": "radroots.rhi.systemd-qualification",
      4   "schema_version": 1,
      5   "service": "rhi",
      6   "unit_path": "packaging/systemd/rhi@.service",
      7   "verification_script": "scripts/verify-systemd.sh",
      8   "unit_sha256": "12e6659042b540d0c202a041ef97714089a0c919a5ef6f6c22c04db744daffdc",
      9   "canonical_lines": [
     10     "[Unit]",
     11     "Description=Radroots RHI evidence service instance %i",
     12     "After=network-online.target",
     13     "Wants=network-online.target",
     14     "StartLimitIntervalSec=0",
     15     "[Service]",
     16     "Type=simple",
     17     "User=rhi",
     18     "Group=rhi",
     19     "UMask=0077",
     20     "ExecStart=/usr/bin/rhi --profile service-host --instance %i run",
     21     "Restart=on-failure",
     22     "RestartSec=5s",
     23     "RestartPreventExitStatus=2 4 5 6",
     24     "TimeoutStopSec=310s",
     25     "KillSignal=SIGTERM",
     26     "FinalKillSignal=SIGKILL",
     27     "ConfigurationDirectory=radroots/services/rhi/%i",
     28     "ConfigurationDirectoryMode=0700",
     29     "StateDirectory=radroots/services/rhi/%i",
     30     "StateDirectoryMode=0700",
     31     "CacheDirectory=radroots/services/rhi/%i",
     32     "CacheDirectoryMode=0700",
     33     "LogsDirectory=radroots/services/rhi/%i",
     34     "LogsDirectoryMode=0700",
     35     "RuntimeDirectory=radroots/services/rhi/%i",
     36     "RuntimeDirectoryMode=0700",
     37     "RuntimeDirectoryPreserve=restart",
     38     "NoNewPrivileges=yes",
     39     "PrivateTmp=yes",
     40     "PrivateDevices=yes",
     41     "ProtectHome=yes",
     42     "ProtectSystem=strict",
     43     "ProtectClock=yes",
     44     "ProtectControlGroups=yes",
     45     "ProtectHostname=yes",
     46     "ProtectKernelLogs=yes",
     47     "ProtectKernelModules=yes",
     48     "ProtectKernelTunables=yes",
     49     "ProtectProc=invisible",
     50     "ProcSubset=pid",
     51     "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
     52     "RestrictNamespaces=yes",
     53     "RestrictRealtime=yes",
     54     "RestrictSUIDSGID=yes",
     55     "LockPersonality=yes",
     56     "CapabilityBoundingSet=",
     57     "AmbientCapabilities=",
     58     "KeyringMode=private",
     59     "RemoveIPC=yes",
     60     "SystemCallArchitectures=native",
     61     "[Install]",
     62     "WantedBy=multi-user.target"
     63   ],
     64   "runtime_posture": {
     65     "type": "simple",
     66     "readiness": "cached_cli_no_sd_notify",
     67     "restartable_exit_codes": [1, 3],
     68     "nonrestartable_exit_codes": [2, 4, 5, 6],
     69     "restart_delay_seconds": 5,
     70     "restart_limit_interval_seconds": 0,
     71     "stop_timeout_seconds": 310,
     72     "runtime_directory_preserve": "restart",
     73     "directory_mode": "0700",
     74     "umask": "0077"
     75   },
     76   "forbidden_directives": [
     77     "ConfigDirectory",
     78     "ConfigDirectoryMode",
     79     "DynamicUser",
     80     "Environment",
     81     "EnvironmentFile",
     82     "ExecStartPost",
     83     "ExecStartPre",
     84     "LoadCredential",
     85     "LoadCredentialEncrypted",
     86     "PassEnvironment"
     87   ],
     88   "verification": {
     89     "minimum_systemd_major": 252,
     90     "maximum_exposure_score": 3.0,
     91     "maximum_exposure_percent": 30,
     92     "syntax_check": "systemd-analyze verify",
     93     "security_check": "systemd-analyze security --offline=yes --threshold=30"
     94   },
     95   "deferred": [
     96     "compatibility_sensitive_memory_deny_write_execute",
     97     "compatibility_sensitive_system_call_filter",
     98     "resource_limits_step_231",
     99     "integration_wave_step_229",
    100     "rcld_promotion_step_235",
    101     "nix",
    102     "oci",
    103     "deployment",
    104     "production_activation"
    105   ]
    106 }