News for hackers. Stuff that matters.

A comment on SystemD Service Hardening.

Re:SystemD Service Hardening by igorramazanov on Monday August 18, 2025 @06:57AM (#44939283)
Automatic systemd service hardening guided by strace profiling

https://github.com/desbma/shh

[ Parent | on HN ]
Re:SystemD Service Hardening by isodude on Monday August 18, 2025 @12:24PM (#44942402)
A nice thing I found is that if you do (which I see they did not in the examples)

  # ProtectSystem=
you can do

  TemporaryFileSystem=/:ro
  BindReadOnly=/usr/bin/binary /lib /lib64 /usr/lib usr/lib64 <paths you want to read>
And essentially just including the binary and the path you want available. ProtectSystem= is currently not compatible with this behavior.

EDIT: More info here: https://github.com/systemd/systemd/issues/33688

[ Parent | on HN ]
Re:SystemD Service Hardening by aidenn0 on Monday August 18, 2025 @05:36PM (#44945606)
Seems that might be an issue for something that wants to e.g. send an e-mail when an error occurs?
[ Parent | on HN ]