From 25decf16175682bb3ab22f05a309d02bc4a22bf6 Mon Sep 17 00:00:00 2001 From: srestegosaurio Date: Sun, 24 Aug 2025 04:08:40 +0200 Subject: [PATCH] systemd: Add example service hardening Include some trivial sandboxing options in the provided service files as an example and lead users to `systemd-analyze security`. While being a trivial change and far from a secure service it is an improvement and may push downstream packagers and/or users to add even a bit of sandboxing. Signed-off-by: srestegosaurio --- systemd/system/radicle-node.service | 5 +++++ systemd/user/radicle-node.service | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/systemd/system/radicle-node.service b/systemd/system/radicle-node.service index 5ec85d73..65abf5c7 100644 --- a/systemd/system/radicle-node.service +++ b/systemd/system/radicle-node.service @@ -25,6 +25,11 @@ Environment=RAD_HOME=/home/seed/.radicle RUST_BACKTRACE=1 RUST_LOG=info KillMode=process Restart=always RestartSec=3 +# Basic hardening options. For more please refer to `systemd-analyze security`. +PrivateTmp=true +ProtectSystem=strict +NoNewPrivileges=true +MemoryDenyWriteExecute=true [Install] WantedBy=multi-user.target diff --git a/systemd/user/radicle-node.service b/systemd/user/radicle-node.service index 55ea89c7..fe28a4b2 100644 --- a/systemd/user/radicle-node.service +++ b/systemd/user/radicle-node.service @@ -18,6 +18,10 @@ Environment=RUST_LOG=info KillMode=process Restart=always RestartSec=3 +# Basic hardening options. For more please refer to `systemd-analyze security`. +PrivateTmp=true +ProtectHome=true +MemoryDenyWriteExecute=true [Install] WantedBy=default.target