#518 Security hardening: more systemd sandboxing for the services

[Anonymous]

Originally created by: athanclark

systemd hardening could go further.

• None of the units set CapabilityBoundingSet=, PrivateDevices=yes, ProtectKernelModules=yes, ProtectKernelLogs=yes, ProtectClock=yes, RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6, RestrictNamespaces=yes, LockPersonality=yes, SystemCallFilter=@system-service, SystemCallArchitectures=native or UMask=0077.
• The mail, syslog and journald units also lack ProtectKernelTunables, ProtectControlGroups and RestrictSUIDSGID (deploy/debian-server/*.service, nix/module.nix:30-38).
• None of this is exploitable now, because the services are non-root with NoNewPrivileges.

---

From the security review of 2026-11-06 (commit 6776c44), finding I-17: hardening or information, filed publicly because it describes no way in. The exploitable findings are private security advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed