systemd unit hardening
main command to interact is
systemd-analyze security; this will give a list of units along with their exposure score (lower is better);take note the goal to a 1.0 score shouldn't be taken as a goal since not all units need are the same; security, after all, is about mitigating against your threat model
the only unit possible to attain the lowest score is a simple "Hello world" program or similar so don't go for a 1.0
several systemd unit options are only available in certain units such as system services
here is a list of sandboxing-related options; for more information, see
systemd.exec.5manual pageProtectHomewill restrict process to interact with/home,/root, and/run/user; can accept a boolean or certain values:read-onlywill set certain directories to read-only andtmpfswill mount the temporary filesystems to the directories as read-only;ProtectControlGroupswill make the control group filesystem (i.e.,/sys/fs/cgroup) to read-onlyPrivateUsers, if enabled, will run the processes through another userProtectClockprohibits interacting with the system clockProtectKernelModulesrestricts loading of kernel modulesProtectKernelLogsprevents logging into the kernel ring bufferPrivateTmpwill create a new temporary filesystem for the unitPrivateNetworkwill create a new set of network devices only composing of a loopback network device; this will disallow network access and thus should only use for processes with no business with network accessPrivateDeviceswill create a new set of devices with only the pseudo-devices (e.g.,/dev/null,/dev/zero); this will restrict device access and should be used for processes with no device accessSystemCallFiltertakes a space-separated list of system calls to be filtered to the unit; if the unit is detected to call one of the listed syscall, systemd will terminate them; while listing them individually is possible, systemd has predefined set of calls putting them into categories; to see them, usesystemd-analyze syscall-filters
extra resources