shh-merge-profile-data(1)

💖 shh-merge-profile-data — General Commands Manual 💖

okay bestie, welcome to the manual page for shh-merge-profile-data from the General Commands Manual. This is the one that merges profile data from previous runs so it can generate systemd options. Let's get into it. ✨

🌸 NAME 🌸

shh-merge-profile-data — Merge profile data from previous runs to generate systemd options

✨ SYNOPSIS ✨

shh merge-profile-data [-i|--instance] [-c|--container] [-m|--mode]
[-f|--network-firewalling] [-w|--filesystem-whitelisting]
[--merge-paths-threshold] [--systemd-options] [-h|--help] <PATHS>

🦋 DESCRIPTION 🦋

Merge profile data from previous runs to generate systemd options. That's the whole mission, bestie: previous-run profile data goes in, merged systemd options come out. 💅

💅 OPTIONS 💅

Here's every flag, every default, every warning — no skips, no cap:

• -i, --instance <INSTANCE> — Systemd instance of the service ("system" or "user" for per-user instances of the service manager). [default: system] [possible values: system, user]
• -c, --container — EXPERIMENTAL Assume the systemd .service unit has been generated from a .container template. 👀
• -m, --mode <MODE> — How hard we should harden. [default: standard] Possible values:
  • generic — Try to generate hardening options that are more likely be portable across different systems for this service. WARNING: This is a best effort attempt, and NOT a guarantee. The only way to ensure the options will work is to run profiling on the same exact system. 😭
  • standard — Only generate hardening options if they have a negligible risk of breaking things. 🫶
  • aggressive — Will harden further and prevent circumventing restrictions of some options, but may increase the risk of breaking services. It is highly recommended to manually review the generated options. 🔥
• -f, --network-firewalling — Enable advanced network firewalling. Only use this if you know that the network addresses and ports of local system and remote peers will not change. 🌐
• -w, --filesystem-whitelisting — Enable whitelist-based filesystem hardening. Only use this if you know that the paths accessed by the service will not change. 📁
• --merge-paths-threshold <MERGE_PATHS_THRESHOLD> — When using whitelist-based filesystem hardening, if path whitelist is longer than this value, try to merge paths with the same parent. [default: 5] 🧚
• --systemd-options <SYSTEMD_OPTIONS>... — Disable all systemd options except these (case sensitive). Other options may be generated when mutating these options to make them compatible with profiling data. For testing only. 🧪
• -h, --help — Print help (see a summary with -h). 🙈
• <PATHS> — Profile data paths. 🛤️

💖 okay that's the whole page, bestie! The footer gives us merge-profile-data and shh-merge-profile-data(1) — no date listed, just those labels — so you know exactly where this manual came from. periodt. 🎀✨