Skip to content

Instantly share code, notes, and snippets.

View sieveLau's full-sized avatar

sieveLau

6 followers · 0 following
  • 22:24 (UTC +08:00)
View GitHub Profile
@sieveLau
sieveLau / systemd_service_hardening.md
Created October 9, 2023 08:07 — forked from ageis/systemd_service_hardening.md
Options for hardening systemd service units

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict