mib mibmo

declarative everything ¯\_(ツ)_/¯

ageis / systemd_service_hardening.md

Last active June 27, 2025 13:40

Options for hardening systemd service units

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict