nerdexam
CompTIA

XK0-005 · Question #10540

The security team has identified a web service that is running with elevated privileges. A Linux administrator is working to change the systemd service file to meet security compliance standards…

The correct answer is C. Adding the User=webservice to the [Service] section of the service file. To prevent a systemd web service from running with elevated privileges, the administrator should explicitly configure it to run as an unprivileged user.

Security

Question

The security team has identified a web service that is running with elevated privileges. A Linux administrator is working to change the systemd service file to meet security compliance standards. Given the following output: [Unit] Description=CompTIA server daemon Documentation=man:webserver(8) man:webserver_config(5) After=network.target [Service] Type=notify EnvironmentFile=/etc/webserver/config ExecStart=/usr/sbin/webserver -D $OPTIONS ExecReload=/bin/kill -HUP SMAINPID KillMode=process Restart=on-failure RestartSec=42s [Install] WantedBy=multi-user.target Which of the following remediation steps will prevent the web service from running as a privileged user?

Options

  • ARemoving the ExecStart=/usr/sbin/webserver -D $OPTIONS from the service file
  • BUpdating the EnvironmentFile line in the [Service] section to /home/webservice/config
  • CAdding the User=webservice to the [Service] section of the service file
  • DChanging the multi-user.target in the [Install] section to basic.target

How the community answered

(29 responses)
  • A
    10% (3)
  • B
    3% (1)
  • C
    79% (23)
  • D
    7% (2)

Why each option

To prevent a systemd web service from running with elevated privileges, the administrator should explicitly configure it to run as an unprivileged user.

ARemoving the ExecStart=/usr/sbin/webserver -D $OPTIONS from the service file

Removing `ExecStart` would prevent the service from starting altogether, which is not a solution for privilege reduction but service disablement.

BUpdating the EnvironmentFile line in the [Service] section to /home/webservice/config

Updating the `EnvironmentFile` path only changes the source for environment variables; it does not alter the user context under which the service runs.

CAdding the User=webservice to the [Service] section of the service fileCorrect

Adding `User=webservice` to the `[Service]` section of the systemd unit file explicitly instructs systemd to run the `ExecStart` command as the `webservice` user, thereby preventing the service from executing with root or other elevated privileges and improving security compliance.

DChanging the multi-user.target in the [Install] section to basic.target

Changing `WantedBy=multi-user.target` to `basic.target` modifies the boot target dependencies, affecting when the service starts, but has no impact on the user privileges of the running service.

Concept tested: Systemd service user configuration

Source: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#User=

Topics

#systemd#Service configuration#User privileges#Security hardening

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full XK0-005 Practice