Using systemd features to secure services
summary
Systemd claims to let services drop privileges, create and remove per-service runtime dirs, and enforce namespaces, capabilities and resource limits so services run without root. Examples: dynamic users creates ephemeral accounts, private network gives a per-service network namespace, socket activation supplies listening sockets before privilege drop, and BPF enables per-unit packet filtering (currently limited). Fedora has ~1,740 unit files (under 1,000 two years ago), so these features scale and do work in practice.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:40Why use systemd
- 2:20Wrapper query
- 3:11Unit files
- 4:15Protections
- 5:06Run
- 6:06Protect Home
- 10:54Protect System
- 12:30Private Temp
- 18:45Private Network
- 20:52Lowlevel options
- 23:26Highlevel options
- 25:29Network filtering
- 26:52Systemd Analyze Security
- 29:34Questions
