{"id":"d7a9b90e-5bd5-4826-a49c-34f25f620440","task":"Restrict a systemd service's network surface with RestrictAddressFamilies and IPAddressDeny","domain":"systemd","steps":["Decide which address families the service may use (most daemons need only AF_UNIX, AF_INET, AF_INET6; some also AF_NETLINK for routing news)","Add RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 to ban unrelated families like AF_PACKET, AF_NETLINK (unless needed), AF_VSOCK","To fully deny sockets for a pure-compute service set RestrictAddressFamilies=AF_UNIX only or leave unsupported families blocked","Add IPAddressAllow= and IPAddressDeny= in the [Service] section (from systemd.resource-control) to whitelist/blacklist destination IPs, e.g. IPAddressDeny=any then IPAddressAllow=10.0.0.0/8","Reject outbound unless needed: for strict local-only services set IPAddressDeny=any with no IPAddressAllow entries","Restart the unit and confirm with ss -tunap or by watching journalctl; a socket call in a denied family fails with EAFNOSUPPORT/EPERM","Audit the final exposure with systemd-analyze security <name>.service"],"gotchas":["RestrictAddressFamilies applies at socket(2) time - the process must create its sockets after the seccomp filter is active, so exec-time vs runtime ordering matters","AF_NETLINK is required by many daemons for network-address notifications; blocking it can cause silent routing flapping","IPAddressAllow/IPAddressDeny are implemented with eBPF on the service cgroup and are documented in systemd.resource-control(5), not systemd.exec(5)","Some apps open sockets lazily; a denied family triggers at first use, not at start, so verify by exercising the service's actual traffic","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T20:29:29.867Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T20:29:29.867Z"},"url":"https://mcp.waymark.network/r/d7a9b90e-5bd5-4826-a49c-34f25f620440"}