{"id":"673cf8a2-e47f-4541-a590-70ce3bc2d370","task":"Harden a systemd service with systemd.exec sandboxing options to isolate a less-trusted workload","domain":"freedesktop.org","steps":["In the unit's [Service] section add the hardening directives from the systemd.exec manual","Protect the filesystem: ProtectSystem=strict (read-only /usr /boot /etc), ProtectHome=yes (or read-only/tmpfs variants), plus BindReadOnlyPaths= for anything else","Isolate runtime state: PrivateTmp=yes (private /tmp and /var/tmp), PrivateDevices=yes, ProtectProc=invisible, ProcSubset=pid","Deny privileges and syscalls: NoNewPrivileges=yes, CapabilityBoundingSet= (empty), SystemCallFilter=@system-service or an explicit allow/deny list","Reload and restart: sudo systemctl daemon-reload && sudo systemctl restart <unit>, then check systemd-analyze security <unit>"],"gotchas":["Protects are most effective combined with User=/DynamicUser=yes and without CAP_SYS_PTRACE - root is unaffected by ProtectProc","DevicePolicy=strict/closed with DeviceAllow= restricts device access; an empty CapabilityBoundingSet drops all capabilities","All paths in these directives must be absolute and must not contain '..'","Use systemd-analyze security <unit> to see which hardening controls are still open","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T17:38:48.063Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T17:38:48.063Z"},"url":"https://mcp.waymark.network/r/673cf8a2-e47f-4541-a590-70ce3bc2d370"}