RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add NixOS NetworkManager-dispatcher, sort exceptions

This commit is contained in:
Thomas Stromberg 2022-09-30 14:21:40 -04:00
parent 5cf9ce6859
commit a19da8f0b8
Failed to extract signature
1 changed files with 35 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
startup/unexpected-active-systemd-units.sql
View File

@ -34,14 +34,15 @@ WHERE
)
AND (
exception_key IN (
"abrtd.service,ABRT Automated Bug Reporting Tool,,400",
"abrt-journal-core.service,Creates ABRT problems from coredumpctl messages,,200",
"abrt-oops.service,ABRT kernel log watcher,,200",
"abrt-xorg.service,ABRT Xorg log watcher,,200",
"abrtd.service,ABRT Automated Bug Reporting Tool,,400",
"accounts-daemon.service,Accounts Service,,1900",
"accounts-daemon.service,Accounts Service,,2100",
"accounts-daemon.service,Accounts Service,,700",
"acpid.path,ACPI Events Check,,100",
"acpid.service,ACPI Daemon,,1100",
"acpid.service,ACPI event daemon,,200",
"acpid.socket,ACPID Listen Socket,,100",
"akmods-keygen.target,akmods-keygen.target,,0",
@ -55,11 +56,12 @@ WHERE
"apcupsd.service,APC UPS Power Control Daemon for Linux,,300",
"apparmor.service,Load AppArmor profiles,,1100",
"apport.service,LSB: automatic crash report generation,,500",
"apt-daily-upgrade.timer,Daily apt upgrade and clean activities,,100",
"apt-daily.timer,Daily apt download activities,,100",
"apt-daily-upgrade.timer,Daily apt upgrade and clean activities,,100",
"archlinux-keyring-wkd-sync.service,Refresh existing keys of archlinux-keyring,,900",
"archlinux-keyring-wkd-sync.timer,Refresh existing PGP keys of archlinux-keyring regularly,,100",
"audit.service,Kernel Auditing,,1200",
"auditd.service,Security Auditing Service,,1700",
"audit.service,Kernel Auditing,,1200",
"avahi-daemon.service,Avahi mDNS/DNS-SD Stack,,1000",
"avahi-daemon.socket,Avahi mDNS/DNS-SD Stack Activation Socket,,800",
"basic.target,Basic System,,900",
@ -67,39 +69,29 @@ WHERE
"blockdev@dev-mapper-cryptoswap.target,Block Device Preparation for /dev/mapper/cryptoswap,,400",
"bluetooth.service,Bluetooth service,,700",
"bluetooth.target,Bluetooth Support,,400",
"sleep.target,Sleep,,400",
"bolt.service,Thunderbolt system service,,600",
"chronyd.service,NTP client/server,,1500",
"colord.service,Manage, Install and Generate Color Profiles,colord,200",
"console-setup.service,Set console font and keymap,,300",
"containerd.service,containerd container runtime,,1200",
"cron.service,Regular background program processing daemon,,300",
"cronie.service,Periodic Command Scheduler,,100",
"cron.service,Regular background program processing daemon,,300",
"cryptsetup.target,Local Encrypted Volumes,,400",
"cups-browsed.service,Make remote CUPS printers available locally,,200",
"cups.path,CUPS Scheduler,,100",
"cups.service,CUPS Scheduler,,200",
"cups.socket,CUPS Scheduler,,100",
"cups.service,CUPS Scheduler,,300",
"NetworkManager-wait-online.service,Network Manager Wait Online,,1200",
"systemd-suspend.service,System Suspend,,500",
"cups.socket,CUPS Scheduler,,100",
"dbus-broker.service,D-Bus System Message Bus,,500",
"archlinux-keyring-wkd-sync.service,Refresh existing keys of archlinux-keyring,,900",
"NetworkManager.service,Network Manager,,1400",
"kolide-launcher.service,Kolide launcher,,1800",
"dbus.service,D-Bus System Message Bus,,400",
"dbus.service,D-Bus System Message Bus,,500",
"dbus.socket,D-Bus System Message Bus Socket,,100",
"acpid.service,ACPI Daemon,,1100",
"dhcpcd.service,DHCP Client,,1700",
"display-manager.service,X11 Server,,1700",
"zfs-scrub.service,ZFS pools scrubbing,,1000",
"dkms.service,Builds and install new kernel modules through DKMS,,200",
"dm-event.socket,Device-mapper event daemon FIFOs,,200",
"iio-sensor-proxy.service,IIO Sensor Proxy service,,400",
"dnf-makecache.service,dnf makecache,,400",
"dnf-makecache.timer,dnf makecache --timer,,300",
"mcelog.service,Machine Check Exception Logging Daemon,,200",
"docker.service,Docker Application Container Engine,,1100",
"docker.service,Docker Application Container Engine,,1200",
"docker.service,Docker Application Container Engine,,1300",
@ -109,13 +101,13 @@ WHERE
"dpkg-db-backup.timer,Daily dpkg database backup timer,,100",
"dracut-shutdown.service,Restore /run/initramfs on shutdown,,500",
"e2scrub_all.timer,Periodic ext4 Online Metadata Check for All Filesystems,,200",
"firewall.service,Firewall,,1500",
"firewalld.service,firewalld - dynamic firewall daemon,,600",
"firewall.service,Firewall,,1500",
"flatpak-system-helper.service,flatpak system helper,,200",
"fprintd.service,Fingerprint Authentication Daemon,,800",
"fprintd.service,Fingerprint Authentication Daemon,,900",
"fstrim.timer,Discard unused blocks once a week,,200",
"fstrim.service,Discard unused blocks on filesystems from /etc/fstab,,400",
"fstrim.timer,Discard unused blocks once a week,,200",
"fwupd-refresh.service,Refresh fwupd metadata and update motd,fwupd-refresh,400",
"fwupd-refresh.timer,Refresh fwupd metadata regularly,,100",
"fwupd.service,Firmware update daemon,,600",
@ -126,6 +118,7 @@ WHERE
"getty.target,Login Prompts,,500",
"graphical.target,Graphical Interface,,600",
"gssproxy.service,GSSAPI Proxy Daemon,,400",
"iio-sensor-proxy.service,IIO Sensor Proxy service,,400",
"import-state.service,Import network configuration from initramfs,,400",
"integritysetup.target,Local Integrity Protected Volumes,,400",
"irqbalance.service,irqbalance daemon,,500",
@ -135,6 +128,7 @@ WHERE
"kerneloops.service,Tool to automatically collect and submit kernel crash signatures,kernoops,300",
"keyboard-setup.service,Set the console keyboard layout,,200",
"kmod-static-nodes.service,Create List of Static Device Nodes,,700",
"kolide-launcher.service,Kolide launcher,,1800",
"kolide-launcher.service,Kolide launcher,,1900",
"launcher.kolide-k2.service,The Kolide Launcher,,200",
"ldconfig.service,Rebuild Dynamic Linker Cache,,600",
@ -158,8 +152,9 @@ WHERE
"machine-qemu\\x2d2\\x2dwin10.scope,Virtual Machine qemu-2-win10,,300",
"machine.slice,Virtual Machine and Container Slice,,400",
"machines.target,Containers,,400",
"man-db.timer,Daily man-db regeneration,,100",
"man-db.service,Daily man-db regeneration,root,700",
"man-db.timer,Daily man-db regeneration,,100",
"mcelog.service,Machine Check Exception Logging Daemon,,200",
"ModemManager.service,Modem Manager,root,400",
"ModemManager.service,Modem Manager,root,500",
"modprobe@efi_pstore.service,Load Kernel Module efi_pstore,,500",
@ -169,16 +164,19 @@ WHERE
"motd-news.timer,Message of the Day,,100",
"mount-pstore.service,mount-pstore.service,,1100",
"multi-user.target,Multi-User System,,500",
"networkd-dispatcher.service,Dispatcher daemon for systemd-networkd,,200",
"network-interfaces.target,All Network Interfaces (deprecated),,100",
"network-local-commands.service,Extra networking commands.,,1300",
"NetworkManager-dispatcher.service,Network Manager Script Dispatcher Service,,600",
"NetworkManager-dispatcher.service,Network Manager Script Dispatcher Service,,700",
"NetworkManager.service,Network Manager,,1300",
"NetworkManager.service,Network Manager,,1400",
"NetworkManager-wait-online.service,Network Manager Wait Online,,1100",
"NetworkManager-wait-online.service,Network Manager Wait Online,,1200",
"network-online.target,Network is Online,,500",
"network-pre.target,Preparation for Network,,500",
"network-setup.service,Networking Setup,,1300",
"network.target,Network,,500",
"networkd-dispatcher.service,Dispatcher daemon for systemd-networkd,,200",
"NetworkManager-dispatcher.service,Network Manager Script Dispatcher Service,,600",
"NetworkManager-wait-online.service,Network Manager Wait Online,,1100",
"NetworkManager.service,Network Manager,,1300",
"nfs-client.target,NFS client services,,400",
"nginx.service,Nginx Web Server,nginx,2400",
"nix-daemon.service,Nix Daemon,,400",
@ -192,7 +190,6 @@ WHERE
"openvpn.service,OpenVPN service,,200",
"packagekit.service,PackageKit Daemon,root,300",
"paths.target,Path Units,,400",
"sleep.target,Sleep,,400",
"pcscd.service,PC/SC Smart Card Daemon,,200",
"pcscd.socket,PC/SC Smart Card Daemon Activation Socket,,100",
"phpsessionclean.timer,Clean PHP session files every 30 mins,,100",
@ -208,6 +205,7 @@ WHERE
"proc-sys-fs-binfmt_misc.automount,Arbitrary Executable File Formats File System Automount Point,,700",
"qemu-kvm.service,QEMU KVM preparation - module, ksm, hugepages,,300",
"raid-check.timer,Weekly RAID setup health check,,100",
"reflector.service,Refresh Pacman mirrorlist with Reflector.,,1500",
"reflector.timer,Refresh Pacman mirrorlist weekly with Reflector.,,100",
"reload-systemd-vconsole-setup.service,Reset console on configuration changes,,1200",
"remote-fs-pre.target,Preparation for Remote File Systems,,400",
@ -220,6 +218,7 @@ WHERE
"setvtrgb.service,Set console scheme,,300",
"shadow.service,Verify integrity of password and group files,,300",
"shadow.timer,Daily verification of password and group files,,100",
"sleep.target,Sleep,,400",
"slices.target,Slice Units,,400",
"smartcard.target,Smart Card,,400",
"snapd.apparmor.service,Load AppArmor profiles managed internally by snapd,,800",
@ -238,8 +237,8 @@ WHERE
"sysinit.target,System Initialization,,500",
"syslog.socket,Syslog Socket,,1400",
"sysstat-collect.timer,Run system activity accounting tool every 10 minutes,,300",
"sysstat-summary.timer,Generate summary of yesterday's process accounting,,300",
"sysstat.service,Resets System Activity Logs,root,400",
"sysstat-summary.timer,Generate summary of yesterday's process accounting,,300",
"systemd-ask-password-console.path,Dispatch Password Requests to Console Directory Watch,,700",
"systemd-ask-password-plymouth.path,Forward Password Requests to Plymouth Directory Watch,,400",
"systemd-ask-password-plymouth.path,Forward Password Requests to Plymouth Directory Watch,,500",
@ -253,14 +252,13 @@ WHERE
"systemd-homed.service,Home Area Manager,,1300",
"systemd-hostnamed.service,Hostname Service,,1100",
"systemd-hostnamed.service,Hostname Service,,1200",
"reflector.service,Refresh Pacman mirrorlist with Reflector.,,1500",
"systemd-initctl.socket,initctl Compatibility Named Pipe,,500",
"systemd-journal-catalog-update.service,Rebuild Journal Catalog,,700",
"systemd-journal-flush.service,Flush Journal to Persistent Storage,,800",
"systemd-journald-audit.socket,Journal Audit Socket,,600",
"systemd-journald-dev-log.socket,Journal Socket (/dev/log),,1100",
"systemd-journald.service,Journal Service,,1800",
"systemd-journald.socket,Journal Socket,,900",
"systemd-journal-flush.service,Flush Journal to Persistent Storage,,800",
"systemd-localed.service,Locale Service,,1200",
"systemd-logind.service,User Login Management,,2000",
"systemd-logind.service,User Login Management,,2100",
@ -276,6 +274,7 @@ WHERE
"systemd-remount-fs.service,Remount Root and Kernel File Systems,,800",
"systemd-resolved.service,Network Name Resolution,systemd-resolve,1700",
"systemd-rfkill.socket,Load/Save RF Kill Switch Status /dev/rfkill Watch,,700",
"systemd-suspend.service,System Suspend,,500",
"systemd-sysctl.service,Apply Kernel Variables,,700",
"systemd-sysusers.service,Create System Users,,1000",
"systemd-timedated.service,Time & Date Service,,1100",
@ -285,35 +284,35 @@ WHERE
"systemd-tmpfiles-setup-dev.service,Create Static Device Nodes in /dev,,700",
"systemd-tmpfiles-setup.service,Create Volatile Files and Directories,,700",
"systemd-tmpfiles-setup.service,Create Volatile Files and Directories,,800",
"systemd-udev-settle.service,Wait for udev To Complete Device Initialization,,800",
"systemd-udev-trigger.service,Coldplug All udev Devices,,700",
"systemd-udevd-control.socket,udev Control Socket,,600",
"systemd-udevd-kernel.socket,udev Kernel Socket,,600",
"systemd-udevd.service,Rule-based Manager for Device Events and Files,,1200",
"systemd-udevd.service,Rule-based Manager for Device Events and Files,,1300",
"systemd-udev-settle.service,Wait for udev To Complete Device Initialization,,800",
"systemd-udev-trigger.service,Coldplug All udev Devices,,700",
"systemd-update-done.service,Update is Completed,,600",
"systemd-update-done.service,Update is Completed,,700",
"systemd-update-utmp.service,Record System Boot/Shutdown in UTMP,,700",
"systemd-update-utmp.service,Record System Boot/Shutdown in UTMP,,800",
"systemd-update-utmp.service,Record System Boot/Shutdown in UTMP,,900",
"systemd-user-sessions.service,Permit User Sessions,,600",
"systemd-user-sessions.service,Permit User Sessions,,700",
"systemd-userdbd.service,User Database Manager,,1100",
"systemd-userdbd.socket,User Database Manager Socket,,600",
"systemd-user-sessions.service,Permit User Sessions,,600",
"systemd-user-sessions.service,Permit User Sessions,,700",
"systemd-vconsole-setup.service,Setup Virtual Console,,600",
"tailscaled.service,Tailscale node agent,,600",
"tailscaled.service,Tailscale node agent,,700",
"time-set.target,System Time Set,,400",
"timers.target,Timer Units,,400",
"time-set.target,System Time Set,,400",
"tlp.service,TLP system startup/shutdown,,500",
"ua-timer.timer,Ubuntu Advantage Timer for running repeated jobs,,100",
"udisks2.service,Disk Manager,,200",
"ufw.service,Uncomplicated firewall,,300",
"unattended-upgrades.service,Unattended Upgrades Shutdown,,300",
"unbound-anchor.timer,daily update of the root trust anchor for DNSSEC,,300",
"updatedb.timer,Daily locate database update,,100",
"update-notifier-download.timer,Download data for packages that failed at package install time,,200",
"update-notifier-motd.timer,Check to see whether there is a new version of Ubuntu available,,300",
"updatedb.timer,Daily locate database update,,100",
"upower.service,Daemon for power management,,900",
"uresourced.service,User resource assignment daemon,,300",
"user.slice,User and Session Slice,,400",
@ -341,6 +340,7 @@ WHERE
"zfs-load-module.service,Install ZFS kernel module,,300",
"zfs-mount.service,Mount ZFS filesystems,,300",
"zfs-mount.service,Mount ZFS filesystems,,400",
"zfs-scrub.service,ZFS pools scrubbing,,1000",
"zfs-scrub.timer,zfs-scrub.timer,,0",
"zfs-share.service,ZFS file system shares,,400",
"zfs-snapshot-daily.service,ZFS auto-snapshotting every day,,1000",
@ -351,11 +351,10 @@ WHERE
"zfs-snapshot-hourly.timer,zfs-snapshot-hourly.timer,,0",
"zfs-snapshot-monthly.timer,zfs-snapshot-monthly.timer,,0",
"zfs-snapshot-weekly.timer,zfs-snapshot-weekly.timer,,0",
"zfs-volume-wait.service,Wait for ZFS Volume (zvol) links in /dev,,200",
"zfs-volumes.target,ZFS volumes are ready,,100",
"zfs-zed.service,ZFS Event Daemon (zed),,200",
"zfs.target,ZFS startup target,,0",
"zfs-volumes.target,ZFS volumes are ready,,100",
"zfs-volume-wait.service,Wait for ZFS Volume (zvol) links in /dev,,200",
"zfs-zed.service,ZFS Event Daemon (zed),,200",
"znapzend.service,ZnapZend - ZFS Backup System,root,1700",
"zpool-trim.timer,zpool-trim.timer,,0"
)