Hardening systemd Services with Sandboxing and Capabilities in Linux
This deep-dive covers systemd service security hardening with actionable analysis, practical implications, and expert insights.
Why Most systemd Services Run Unprotected
By default, a systemd unit running under a dedicated user account can still read world-readable configuration files in /etc, access /tmp, and make outbound network connections. Modern systemd provides built-in kernel sandboxing directives that require zero additional runtime dependencies.
Key Security Directives for systemd Units
[Service]
# File System Isolation
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadOnlyPaths=/usr /bin /sbin /lib
ReadWritePaths=/var/log/my-app /var/run/my-app
# Privilege Escalation Prevention
NoNewPrivileges=true
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
# Kernel and Device Sandboxing
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictNamespaces=true
MemoryDenyWriteExecute=trueWas this technical analysis helpful?
Your feedback informs our benchmark updates and ongoing article audits.
FAQ
Frequently Asked Questions
Structured for search engines and AI answer systems (AEO/GEO).
Run systemd-analyze security your-service-name.service in your terminal to see a scored security audit with actionable recommendations.
More answers in our FAQ hub.
Newsletter
Practical Linux & Applied AI Newsletter
Get new tested tutorials and benchmark comparisons delivered directly to your inbox. Zero spam.
Join Weekly guides readers getting our weekly digest.
- Practical Linux administration & terminal workflows
- Tested open-source AI setups & benchmarks
- Zero spam - unsubscribe anytime
