Systemd/Hardening - Revision history

RossSmyth: /* Hardened service unit example */ The state directory does not need to be bindmounted, systemd does that automatically.

2026-11-09T22:24:10Z

Hardened service unit example: The state directory does not need to be bindmounted, systemd does that automatically.

← Older revision		Revision as of 22:24, 9 November 2026
Line 151:		Line 151:
	# r/w.		# r/w.
	BindPaths = [		BindPaths = [
	~~"/var/lib/coolService"~~
	cfg.sharedDirectory		cfg.sharedDirectory
	];		];

Hrenard: Fix some typos in the example

2026-08-15T14:01:47Z

Fix some typos in the example

← Older revision		Revision as of 14:01, 15 August 2026
Line 165:		Line 165:
	"${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"		"${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
	# For DNS, failably attempts to mount the file		# For DNS, failably attempts to mount the file
	"-/etc/~~resolve~~.conf"		"-/etc/resolv.conf"
	]		]
	# For if the user uses systemd-resolved instead		# For if the user uses systemd-resolved instead
Line 190:		Line 190:
	#		#
	# Can almost always be set, or set to an empty string if no network access is required.		# Can almost always be set, or set to an empty string if no network access is required.
	~~RestrictAddresFamilies~~ = [		RestrictAddressFamilies = [
	"AF_UNIX" # Unix sockets		"AF_UNIX" # Unix sockets
	"AF_INET" # ipv4		"AF_INET" # ipv4

RossSmyth: /* Hardened service unit example */ add memorydenywriteexecutable

2026-08-06T20:23:29Z

Hardened service unit example: add memorydenywriteexecutable

← Older revision		Revision as of 20:23, 6 August 2026
Line 366:		Line 366:
	# Should almost always be enabled		# Should almost always be enabled
	RestrictNamespaces = true;		RestrictNamespaces = true;

			# Disables memory being able to be writable and executable.
			# The only time this should be disabled is with a JIT runtime like
			# .NET, the JVM, and others.
			# There are also some C programs that use trampolines that require this
			# disabled as well.
			#
			# Should usually be enabled.
			MemoryDenyWriteExecute = true;
	};		};
	};		};

RossSmyth: /* Hardened service unit example */ typo

2026-08-06T20:20:33Z

Hardened service unit example: typo

← Older revision		Revision as of 20:20, 6 August 2026
Line 144:		Line 144:

	# Mount the entire fs as read-only.		# Mount the entire fs as read-only.
	~~ProtestSystem~~ = "strict";		ProtectSystem = "strict";

	# bind-mounts paths into the mount namespace as read/write		# bind-mounts paths into the mount namespace as read/write

RossSmyth: /* Hardened service unit example */ Forgot quotes

2026-08-06T20:19:23Z

Hardened service unit example: Forgot quotes

← Older revision		Revision as of 20:19, 6 August 2026
Line 151:		Line 151:
	# r/w.		# r/w.
	BindPaths = [		BindPaths = [
	/var/lib/coolService		"/var/lib/coolService"
	cfg.sharedDirectory		cfg.sharedDirectory
	];		];

RossSmyth: /* Hardened service unit example */ add more annotation about why the pivot_root is done

2026-08-06T20:18:17Z

Hardened service unit example: add more annotation about why the pivot_root is done

← Older revision		Revision as of 20:18, 6 August 2026
Line 119:		Line 119:
	# This does a pivot_root to the tmpfs directory created with the above option.		# This does a pivot_root to the tmpfs directory created with the above option.
	# This create an empty root filesystem on the tmpfs, and the service's mount namespace		# This create an empty root filesystem on the tmpfs, and the service's mount namespace
	# is rooted to this directory. This greatly limits the filesystem a service can observe.		# is rooted to this directory. This greatly limits the filesystem a service can observe,
			# and the whole filesystem is destroy when the service stops, thus no other
			# system processes can access it at the end of the lifetime.
			#
			# Highly recommended.
	RootDirectory = "/run/coolService";		RootDirectory = "/run/coolService";

RossSmyth: Add example service unit with annotations

2026-08-06T20:16:27Z

Add example service unit with annotations

Show changes

RossSmyth: Add Navidrome to the "good" links

2026-08-06T18:58:19Z

Add Navidrome to the "good" links

← Older revision		Revision as of 18:58, 6 August 2026
Line 98:		Line 98:
	<translate>		<translate>
	<!--T:18-->		<!--T:18-->
			* Navidrome: https://github.com/NixOS/nixpkgs/blob/445d861c6d31b4af0c79d8d4be2331f762a361d7/nixos/modules/services/audio/navidrome.nix#L167-L225
	* Chrony: https://github.com/NixOS/nixpkgs/pull/104944/files		* Chrony: https://github.com/NixOS/nixpkgs/pull/104944/files
	* Isso: https://github.com/NixOS/nixpkgs/pull/140840/files		* Isso: https://github.com/NixOS/nixpkgs/pull/140840/files
Line 109:		Line 110:
	<translate>		<translate>
	<!--T:20-->		<!--T:20-->
	* SHH, systemd hardening helper: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]		* SHH, systemd hardening helper, note this tool is not exhaustive and is just a good first-step: [https://www.synacktiv.com/en/publications/systemd-hardening-made-easy-with-shh systemd hardening made easy with SHH]
	</translate>		</translate>

桃源郷: First time editing the wiki, apologies if I did anything wrong! I didn't want to remove the tmux stuff added by others, so I kept my changes to a sentence or two inserted before it

2025-12-30T04:01:12Z

First time editing the wiki, apologies if I did anything wrong! I didn't want to remove the tmux stuff added by others, so I kept my changes to a sentence or two inserted before it

← Older revision		Revision as of 04:01, 30 December 2025
Line 25:		Line 25:
	<translate>		<translate>
	<!--T:7-->		<!--T:7-->
	While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for example to check access to files, or check the network connectivity. ~~One way~~ to do this ~~is to~~ use tmux to create a session inside the service, and attaching to it outside of the service.		While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for example to check access to files, or check the network connectivity. Since systemd v258, one may run <code>systemd-analyze unit-shell <service></code> to accomplish this. Note that this [https://mastodon.social/@zihco/114823612021351075 currently] only works for running services. Alternatively, one might use tmux to create a session inside the service, and attaching to it outside of the service.
	</translate>		</translate>
	<translate>		<translate>

Kiri: Fix small typo

2025-01-20T09:51:29Z

Fix small typo

← Older revision		Revision as of 09:51, 20 January 2025
Line 25:		Line 25:
	<translate>		<translate>
	<!--T:7-->		<!--T:7-->
	While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for ~~exemple~~ to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.		While hardening a service, it often happens that you want a shell inside a hardened systemd unit, for example to check access to files, or check the network connectivity. One way to do this is to use tmux to create a session inside the service, and attaching to it outside of the service.
	</translate>		</translate>
	<translate>		<translate>