shh-run(1)

💖 NAME 💖

okay so bestie, this is shh-run(1) from the General Commands Manual — and it's literally the glow-up page for running a program so you can profile its behavior. main character energy fr fr 💅✨

🦋 SYNOPSIS 🦋

shh run [-i|--instance] [-c|--container] [-m|--mode]
[-f|--network-firewalling] [-w|--filesystem-whitelisting]
[--merge-paths-threshold] [--systemd-options] [-p|--profile-data-path]
[-l|--strace-log-path] [-h|--help] <COMMAND>

🌸 DESCRIPTION 🌸

Run a program to profile its behavior. that's the whole vibe — you run the thing, it gets profiled, you get the tea ☕👑

✨ OPTIONS ✨

• -i, --instance <INSTANCE> [default: system] — systemd instance of the service. lowkey your choices are "system" or "user" for per-user instances of the service manager 🫶

[possible values: system, user]

• -c, --container — EXPERIMENTAL bestie!! assume the systemd .service unit has been generated from a .container template. it's giving experimental, so don't forget that part 💀
• -m, --mode <MODE> [default: standard] — how hard we should harden. like, how much are we locking things down? 👑

Possible values:

• generic — try to generate hardening options that are more likely to be portable across different systems for this service. WARNING: this is a best effort attempt, and NOT a guarantee. the only way to ensure the options will work is to run profiling on the same exact system 😭 no cap.
• standard — only generate hardening options if they have a negligible risk of breaking things. safe-ish queen behavior 🌸
• aggressive — will harden further and prevent circumventing restrictions of some options, but may increase the risk of breaking services. it is highly recommended to manually review the generated options. highkey read them before you commit, bestie 🙈🔥

• -f, --network-firewalling — enable advanced network firewalling. only use this if you know that the network addresses and ports of local system and remote peers will not change. like, if those addresses are gonna shift? do not. 🚫🌐
• -w, --filesystem-whitelisting — enable whitelist-based filesystem hardening. only use this if you know that the paths accessed by the service will not change. paths gotta stay put, periodt 🎀
• --merge-paths-threshold <MERGE_PATHS_THRESHOLD> [default: 5] — when using whitelist-based filesystem hardening, if path whitelist is longer than this value, try to merge paths with the same parent. cute little path-grouping moment 🧚💜
• --systemd-options <SYSTEMD_OPTIONS>... — disable all systemd options except these (case sensitive). other options may be generated when mutating these options to make them compatible with profiling data. for testing only 🧪✨
• -p, --profile-data-path <PROFILE_DATA_PATH> — generate profile data file to be merged with others instead of generating systemd options directly. it's giving "collect the data first, merge later" 💖
• -l, --strace-log-path <STRACE_LOG_PATH> — log strace output to this file. only use for debugging: this will slow down processing, and may generate a huge file. debugging only!! your disk is gonna be like 😭💀 if you're not careful.
• -h, --help — print help (see a summary with '-h'). iconic little helper behavior 🫶
• <COMMAND> — the command line to run. this is literally the program you're sending into the profiling machine 🌈⭐

okay bestie, that's the whole page — and the cute little sign-off at the very end says this is sourced from run on the left and shh-run(1) on the right, under the General Commands Manual 💅🎀 you're welcome, go profile something iconic ✨