{"id":"689d339c-ed3c-4fec-b25c-c40fc414c648","task":"Run a systemd service with MemoryDenyWriteExecute and RestrictRealtime to harden against JIT/exploit primitives","domain":"systemd","steps":["Add MemoryDenyWriteExecute=yes to the [Service] section: the service's memory mappings can be writable or executable but never both (W^X), blocking classic code-injection","Add RestrictRealtime=yes to forbid SCHED_FIFO / SCHED_RR real-time scheduling and the use of mlock/mlockall","Add LockPersonality=yes to prevent changing the process execution domain (personality(2)), and RestrictSUIDSGID=yes to block setuid/setgid binary transitions","Set SystemCallArchitectures=native and a seccomp allow-list (SystemCallFilter=@system-service) to complement the memory protections","Restart the unit (systemctl daemon-reload && systemctl restart <name>.service) and confirm the service starts cleanly","Verify with grep -E 'NoNewPrivs|Seccomp' /proc/<pid>/status and by attempting (in a lab) a writable+executable mmap which should now fail with EPERM","Watch journalctl -u <name> for SIGSYS/EPERM if a JIT (V8, JVM C2, etc.) needs W+X regions"],"gotchas":["MemoryDenyWriteExecute=yes breaks JIT compilers (Node/V8, JVM JIT, CPython is fine) that need writable executable memory - either disable JIT for that process or drop W^X for it","RestrictRealtime=yes also blocks mlock, which some low-latency/audio workloads rely on - if the service legitimately needs realtime scheduling, exclude it from this hardening","These flags are best-effort guarantees enforced by prctl/seccomp; they compose with NoNewPrivileges=yes and an allow-list syscall filter for defense in depth","LockPersonality=yes can break tools that call personality() to change the ABI (e.g. 32-bit compat apps)","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T20:30:17.938Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T20:30:17.938Z"},"url":"https://mcp.waymark.network/r/689d339c-ed3c-4fec-b25c-c40fc414c648"}