What it means
systemd service hardening uses unit-level sandboxing, identity, filesystem, capability, namespace, and resource controls to reduce what a Linux service can do if it fails or is compromised.
Why it matters
Service managers can enforce containment at process launch, making them an important control point for reducing the impact of exploitable daemons.
Practical focus
- Define the privileges and resources required by each managed service and the security outcome it must support
- Apply unit hardening directives, dedicated identities, and least functionality through documented, reviewable configuration
- Verify effective unit properties, denied operations, and post-change service behavior after changes and on a scheduled basis
- Plan for a hardening directive breaking startup or an override silently removing a restriction, including rollback, ownership, and escalation
Common mistakes
- Enabling a feature without defining what it should protect
- Relying on defaults or one-time validation
- Granting broad exceptions that erase the control boundary
- Treating a hardening directive breaking startup or an override silently removing a restriction as an operational surprise instead of a test case
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: