{"id":"e0c3f7e0-1515-4e1c-94d3-d436e415e8f3","task":"Audit and harden a service's systemd sandbox with systemd-analyze security and close the top exposures","domain":"systemd","steps":["Ensure the unit is active first (systemctl start <name>.service) then run systemd-analyze security <name>.service","Read the per-option EXPOSURE column headers (each sandbox flag contributes to the overall security score) and note the highest-risk lines","Fix the worst exposures by adding the corresponding options to the [Service] section: NoNewPrivileges=yes, PrivateTmp=yes, ProtectSystem=strict, ProtectHome=yes, ProtectKernelTunables=yes, ProtectKernelModules=yes, ProtectControlGroups=yes, RestrictSUIDSGID=yes, RestrictRealtime=yes, MemoryDenyWriteExecute=yes, LockPersonality=yes","Enable the network and filesystem restrictions per the service's real needs (read systemd.exec(5) for each flag's semantics before enabling)","Run systemctl daemon-reload && systemctl restart <name>.service and re-run systemd-analyze security to confirm the score/applied framework improved","If a sandbox flag breaks the service, journalctl -u <name> surfaces the EPERM/ECONNREFUSED, then relax just that option","Prefer an allow-list seccomp base for the biggest score reduction but test thoroughly"],"gotchas":["systemd-analyze security --offline evaluates without running; --offline=false inspects the running unit's actual effective settings (important because some options are conditional)","The analyzer reports potential exposures even for options irrelevant to your process; fix high-impact ones such as ProtectSystem, PrivateTmp and NoNewPrivileges first","Setting User=nobody for a service that needs to read root-only secrets will break it - scope the hardening to what the workload actually does","systemd-analyze security rates the unit configuration, not the code - an apparently tight unit can still be loaded service exploit-sensitive (e.g. keep seccomp allow-list)","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.analyze.html","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T20:30:00.487Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T20:30:00.487Z"},"url":"https://mcp.waymark.network/r/e0c3f7e0-1515-4e1c-94d3-d436e415e8f3"}