Systemd & NetworkManager Integration
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The DNS hardening project for Parrot OS relies on a specific integration strategy with systemd and NetworkManager to ensure that local DNS resolution remains secure and persistent. By disabling default dynamic DNS management and masking conflicting services, the system forces all traffic through a hardened Unbound resolver.
The primary goal of this integration is to prevent external applications (such as Portmaster) or system services (such as NetworkManager's internal client) from overwriting the /etc/resolv.conf file. This is achieved through service masking, configuration overrides, and the application of file-system level protections.
Sources: README.md:12-23, scripts/dns_harden.sh:37-47, CHANGELOG.md:32-37
Service Management and Conflict Resolution
To implement a local resolver, the project must manage two primary systemd services: unbound and systemd-resolved. Because both services typically compete for port 53, the integration logic explicitly disables the default systemd resolver.
Service Orchestration Flow
The hardening process follows a strict sequence to ensure service availability without port conflicts.
The diagram above illustrates the service state transitions required to transition from a default system state to a hardened state.
Sources: README.md:27-38, DNS_Hardening_Complete_Guide.md:31-41
Service States
| Service | Action During Hardening | Action During Restoration | Purpose |
|---|---|---|---|
unbound | Unmask, Enable, Start | Stop, Mask | Local DNS over TLS resolver |
systemd-resolved | Stop, Mask | Stop, Mask | Default system resolver (disabled to avoid port 53 conflict) |
Sources: scripts/dns_restore.sh:58-62, scripts/dns_restore.sh:91-92, README.md:33-38
NetworkManager Configuration Override
NetworkManager traditionally manages /etc/resolv.conf dynamically based on DHCP leases. To maintain hardening, this behavior is overridden using a custom configuration snippet in /etc/NetworkManager/conf.d/dns-hardening.conf.
The integration disables the internal DNS client and ensures that NetworkManager does not attempt to update the system resolver settings.
[main]
dns=none
systemd-resolved=false
rc-manager=unmanaged
Sources: scripts/dns_harden.sh:53-58, TEST_RESULTS.md:46-51
This configuration is verified during system status checks to ensure that the "dns-hardening.conf" file is present and correctly configured.
Sources: scripts/dns_status.sh:34-38
Immutable Resolver Protection
The project uses the chattr utility to interact with the Linux file system attributes. By setting the immutable flag (+i), the project ensures that neither systemd-resolved nor NetworkManager can modify /etc/resolv.conf, even if the services are running with root privileges.
Hardening vs. Restoration Logic
The sequence diagram shows how the immutable flag acts as a gatekeeper between the configuration scripts and system services.
Sources: scripts/dns_harden.sh:37-51, scripts/dns_restore.sh:76-79, README_SHORT.md:54-55
Systemd-Resolved Fallback Configuration
While systemd-resolved is masked and stopped in the standard hardened configuration, the project provides an optional configuration for /etc/systemd/resolved.conf. This is intended to point systemd-resolved toward the local Unbound instance if it were ever re-enabled, while disabling its internal stub listener to prevent conflicts.
| Parameter | Value | Description |
|---|---|---|
DNS | 127.0.0.1 | Sets Unbound as the primary resolver |
FallbackDNS | 1.1.1.1 | Provides redundancy |
DNSStubListener | no | Prevents conflict on port 53 |
LLMNR | no | Disables Link-Local Multicast Name Resolution |
MulticastDNS | no | Disables mDNS for security |
Sources: README.md:143-157, DNS_Hardening_Complete_Guide.md:167-181
Conclusion
The integration of DNS hardening within the systemd and NetworkManager ecosystems is achieved through a combination of service suppression and file-system level immutability. By masking systemd-resolved and configuring NetworkManager to an "unmanaged" state for DNS, the system successfully routes all traffic through Unbound, ensuring that security features like DNS over TLS and DNSSEC remain active and tamper-proof.