Back to the article

Service hardening: User=, ProtectSystem, NoNewPrivileges

cheat sheet · Ubuntu 24.04 · systemd 255 https://lab.dimsanych.ru/en/wiki/systemd-hardening/

Cheat sheet

systemd-analyze security rating of every service
systemd-analyze security app settings table and total
systemd-analyze security --threshold=50 app exit code 1 above 5.0
systemctl show app -p User -p ProtectSystem -p NoNewPrivileges
sudo systemctl edit app drop-in with limits
ps -o user,pid,cmd -C python3 who runs the process
sudo systemd-run --pipe --wait -q -p User=demo id try a setting