Provide a service writable ephemeral dirs while keeping the rest of the filesystem read-only (ProtectSystem=strict + ReadWritePaths/StateDirectory)

domain: systemd · 7 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗

Documented steps

  1. Add ProtectSystem=strict to make / (except /dev, /proc, /sys and the runtime state dirs) read-only
  2. Declare the service's writable dirs: add RuntimeDirectory=, StateDirectory=, CacheDirectory=, LogsDirectory=, ConfigurationDirectory= in the [Service] section (systemd auto-creates them under /run, /var/lib, /var/cache, /var/log, /etc and makes them owned/writable by the service user)
  3. Add ReadWritePaths=/path/one /path/two for any extra absolute dirs the service must write that are outside the managed state dirs
  4. Add ReadOnlyPaths= and InaccessiblePaths= to further pin specific paths to ro or empty/absent for the service
  5. Combined with DynamicUser=yes the state/cache/log dirs get correct per-service ownership automatically (chown is done by systemd)
  6. Restart, then from inside the service confirm /etc, /usr, /opt are read-only while RuntimeDirectory/StateDirectory are writable
  7. Re-run systemd-analyze security <name>.service to confirm filesystem exposure dropped

Known gotchas

Give your agent this knowledge — and 18,000+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans