shh-servic...art-profile(1)

🎀 shh-service-start-profile(1) 🎀

okay bestie, buckle up — this is the shh-service-start-profile page from the General Commands Manual, and it's literally about adding fragment config to a service so you can profile how it behaves. yes, that's the whole vibe. let's get into it 💅

✨ NAME ✨

shh-service-start-profile — add fragment config to a service to profile its behavior 🫶

🌸 SYNOPSIS 🌸

shh service start-profile [-i|--instance] [-m|--mode]
[-f|--network-firewalling] [-w|--filesystem-whitelisting]
[--merge-paths-threshold] [--systemd-options] [-n|--no-restart]
[-r|--refresh] [-h|--help] <NAME>

like, that's the shape of it. flags first, then the <NAME> at the end, bestie. no cap.

💖 DESCRIPTION 💖

Add fragment config to service to profile its behavior ✨

that's it. that's the description. she's short and she knows it. 👑

💅 OPTIONS 💅

• -i, --instance <INSTANCE> [default: system] — the systemd instance of the service. also accepts user for per-user instances of the service manager. possible values: system, user. so basically: are we doing the system-wide thing or the lil per-user thing? 🧚
• -m, --mode <MODE> [default: standard] — how hard we should harden 🔥 possible values are:
  • generic — try to generate hardening options that are more likely to be portable across different systems for this service. WARNING: this is a best effort attempt, and NOT a guarantee. the only way to ensure the options will work is to run profiling on the same exact system. so like… it's giving hopeful, not promised. 😭
  • standard — only generate hardening options if they have a negligible risk of breaking things. the safe lil default, we love her. 🎀
  • aggressive — will harden further and prevent circumventing restrictions of some options, but may increase the risk of breaking services. it is highly recommended to manually review the generated options. main character energy but she bites. 💀
• -f, --network-firewalling — enable advanced network firewalling. only use this if you know that the network addresses and ports of local system and remote peers will not change. iykyk. 🔥
• -w, --filesystem-whitelisting — enable whitelist-based filesystem hardening. only use this if you know that the paths accessed by the service will not change. 🦋
• --merge-paths-threshold <MERGE_PATHS_THRESHOLD> [default: 5] — when using whitelist-based filesystem hardening, if the path whitelist is longer than this value, try to merge paths with the same parent. lowkey a tidy-up vibe. ✨
• --systemd-options <SYSTEMD_OPTIONS>... — disable all systemd options except these (case sensitive). other options may be generated when mutating these options to make them compatible with profiling data. for testing only. 🙈
• -n, --no-restart — disable immediate service restart. 🛑
• -r, --refresh — disable previous hardening fragment, if it exists. 🧹
• -h, --help — print help (see a summary with -h). iconic of her honestly. 💜
• <NAME> — service unit name. the star of the show, the one you actually have to give. ⭐

ok bestie real talk — the generic mode is best effort and NOT a guarantee, and aggressive may increase the risk of breaking services, and you should highly consider manually reviewing what it generates. and --systemd-options is for testing only. don't come for me if you skip the warnings, i warned you like three times. 💀

🦋 SEE ALSO 🦋

(not gonna lie, this page didn't give us any SEE ALSO refs — she's mysterious like that. 🙈)

sign-off time, bestie: this lil beauty comes from start-profile, lives in the shh-servic...art-profile(1) corner of the General Commands Manual, and that footer showed up on both sides of the page, so you know it's fr fr. 💖 go forth and profile responsibly, queen. 🎀✨👑