A service's least privilege (User=, ProtectSystem, NoNewPrivileges, systemd-analyze security, capabilities), an AppArmor denial on top of permissions and a profile edit, an audit rule auditctl -w and reading an event with ausearch. The questions follow the lessons “A service with least privilege”, “AppArmor: when the profile denies access” and “Who changed the file: auditd”.
10 questions · threshold 70%