Drop-in .conf files for sandboxing systemd services.

View the guide.conf file in the root of this repository for a short explanation of each option. Most comments come from systemd.exec(5) and systemd.resource-control(5) man pages. Most options come from all of the options that systemd-analyze security uses to score a service.

Simply copy the *.service.d files to /etc/systemd/system/.

If you want to install as a package, I maintain a PKGBUILD:

$ git clone https://github.com/krathalan/pkgbuilds
$ cd pkgbuilds/krathalans-systemd-sandboxing-git
$ less PKGBUILD # Always inspect PKGBUILDS before running makepkg!
$ makepkg -i

This package installs .conf files to /usr/lib/systemd/system/*.service.d/.

• bluetooth
• dictd
• dovecot
• fail2ban
• iwd
• nginx
• opendkim
• opendmarc
• org.cups.cupsd
• pkgstats
• postfix
• usbguard

The cupsd overrides have only been tested with an HP printer on the local network. Printers from other manufacturers or printers connected via a different interface (e.g. USB, SAMBA, etc.) may not work. Patches accepted.

The dictd overrides assume that you only want to access the dictd server from your local machine. The pid file is somewhat useless, so its default location is not writable with these hardening options. Here is an example dictd.conf snippet for these hardening options:

global {
    site site.info
    pid_file /dev/null
}

# who's allowed.  You might want to change this.
access {
  allow 127.0.0.*
}

This snippet makes dictd not create a pid file and only allow access from the localhost.

Some sandboxing options, like those used for nginx, opendkim, and opendmarc, assume you are running the service as an unprivileged user. There is also a user.conf file in their directory, in addition to the regular hardening.conf.

See these links for more information:

https://wiki.archlinux.org/index.php/Nginx#Running_unprivileged_using_systemd

https://wiki.archlinux.org/index.php/OpenDKIM#Security

The sshd override only adds IPAccounting, no sandboxing.

The systemd-logind override only adds the service to the proc group, un-breaking the service when /proc is mounted with hidepid=2,gid=proc.

The systemd-networkd override only adds apparmor.service to the After= option, so that the service doesn't start before its AppArmor profile is loaded.