{"id":"c592d2db-4dab-4704-a2bd-be6004d6a93b","task":"Run an untrusted command with systemd's per-call sandbox (systemd-run --scope) with no persistence and immediate teardown","domain":"systemd","steps":["Run a transient sandbox in the current cgroup: systemd-run --scope --user=false -p ProtectSystem=strict -p ProtectHome=yes -p PrivateTmp=yes -p PrivateDevices=yes -p NoNewPrivileges=yes -p RestrictAddressFamilies=AF_UNIX -- /path/to/script","Clear capabilities and seccomp for the call: add -p CapabilityBoundingSet= -p SystemCallFilter='@system-service' -p MemoryDenyWriteExecute=yes","Use --description / --unit to tag the transient scope for observability (systemd-run -p ... --unit=tmp-test ...)","For a one-shot that must exit (journaling the result), add --wait so systemd-run blocks and returns the spawned command's exit status","Watch the live result: systemctl status run-u<id>.scope or journalctl -u run-u<id>.scope","Because no unit file is written, there is nothing to clean up after the process exits - the transient scope disappears automatically","Confirm the sandbox held, e.g. the process's /proc/<pid>/status shows NoNewPrivs=1 and Seccomp=2"],"gotchas":["--scope runs synchronously in your current session and inherits your environment/fds; use a transient service (drop --scope) if you need it to outlive the caller","A transient scope without --wait returns immediately, so capture logs with journalctl --user/sudo -u before the scope is garbage-collected","Root-only sandbox flags (-p ProtectSystem=strict, CapabilityBoundingSet) are ignored or rejected for unprivileged --user transient units; run with sudo for max hardening","systemd-run property names must be valid systemd.exec options - an invalid -p aborts with 'Unknown assignment'","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T20:30:47.539Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T20:30:47.539Z"},"url":"https://mcp.waymark.network/r/c592d2db-4dab-4704-a2bd-be6004d6a93b"}