{"id":"6114f9b4-8edc-4102-b6e1-857b3ed0dd65","task":"Apply the full systemd sandboxing profile to a long-running service (ProtectSystem, ProtectHome, NoNewPrivileges, PrivateTmp) so it cannot modify host files or require root","domain":"systemd","steps":["Create a unit /etc/systemd/system/<name>.service with Type=exec for long-running processes so systemd waits for execve to succeed","Add User= and Group= (or DynamicUser=yes) to drop from root; use DynamicUser=yes when the service needs an ephemeral uid with no static account","Add ProtectSystem=strict to make /usr, /boot, /etc read-only, and ProtectHome=yes to hide /home, /root, /run/user","Add PrivateTmp=yes (private /tmp and /var/tmp), PrivateDevices=yes (private /dev with only null/zero/random/tty), and NoNewPrivileges=yes to block setuid escalation","Add ProtectKernelTunables=yes, ProtectKernelModules=yes, ProtectControlGroups=yes, ProtectKernelLogs=yes to read-only-protect /proc/sys, /sys, /sys/fs/cgroup and block dmesg","Run systemctl daemon-reload && systemctl enable --now <name>.service, then systemctl status to confirm active","Audit with systemctl cat <name>.service and systemd-analyze security <name>.service --offline=false to review the exposure score"],"gotchas":["ProtectSystem=strict makes the entire filesystem read-only except /dev, /proc, /sys and your StateDirectory/CacheDirectory/LogsDirectory/RuntimeDirectory (use ReadWritePaths= to open specific dirs)","ProtectHome=yes provides no access to /home and /root at all (values: yes=unmounted, read-only=mounted ro, tmpfs=empty writable tmpfs)","NoNewPrivileges=yes cannot be combined with AmbientCapabilities= or with user namespaces that need to regain privileges; services that need setuid helpers will fail","File permissions under /tmp may change when using PrivateTmp: use RuntimeDirectory= under /run instead of hardcoding /tmp paths","Some options (User=/ProtectProc=) require the kernel > 4.14 and systemd >= 240-247; verify your distro's systemd version with systemctl --version","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T20:27:05.868Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T20:27:05.868Z"},"url":"https://mcp.waymark.network/r/6114f9b4-8edc-4102-b6e1-857b3ed0dd65"}