{{Header}}
{{Title|title=
systemd
}}
{{#seo:
|description=systemd versus non-systemd / Miscellaneous / Find systemd dependency cycles.
}}
<div class="mininav">
* [[systemd|systemd]]
* [[seccomp|seccomp]]
</div>
{{intro|
systemd versus non-systemd / Miscellaneous / Find systemd dependency cycles.
}}

= systemd security features =
{{IntroLike|
Systemd has a long list of security hardening features for systemd unit files.

Non-exhaustive list. Written April 2026.

The goal of the list isn't replacing systemd upstream documentation, completeness, or perfection. The purpose is to provide a rationale for using systemd.
}}

This table intentionally uses short upstream verbatim excerpts that give a reader an initial clue why a directive can improve service isolation. For some settings, especially <code>DynamicUser=</code> together with the directory helpers, the security benefit is clearest when multiple directives are combined.

{| class="wikitable"
|+ systemd service hardening directives with upstream verbatim excerpts
|-

! <!-- directive --> Directive
! <!-- quote --> Upstream excerpt
|-

! <!-- directive --> <code>NoNewPrivileges=yes</code>
| <!-- quote --> {{quotation
|quote=can never gain new privileges through execve()
}} <ref name=systemd-exec>[https://www.freedesktop.org/software/systemd/man/systemd.exec.html systemd.exec(5)]</ref>
|-

! <!-- directive --> <code>PrivateTmp=yes</code>
| <!-- quote --> {{quotation
|quote=private /tmp/ and /var/tmp/ directories
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>PrivateDevices=yes</code>
| <!-- quote --> {{quotation
|quote=turn off physical device access by the executed process
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProtectSystem=strict</code>
| <!-- quote --> {{quotation
|quote=the entire file system hierarchy is mounted read-only
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProtectHome=read-only</code>
| <!-- quote --> {{quotation
|quote=the three directories are made read-only instead
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProtectControlGroups=yes</code>
| <!-- quote --> {{quotation
|quote=will be made read-only to all processes of the unit
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProtectKernelTunables=yes</code>
| <!-- quote --> {{quotation
|quote=kernel variables accessible through /proc/sys/, /sys/, /proc/sysrq-trigger, /proc/latency_stats, /proc/acpi, /proc/timer_stats, /proc/fs and /proc/irq will be made read-only
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProtectKernelModules=yes</code>
| <!-- quote --> {{quotation
|quote=explicit module loading will be denied
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProtectKernelLogs=yes</code>
| <!-- quote --> {{quotation
|quote=access to the kernel log ring buffer will be denied
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProtectClock=yes</code>
| <!-- quote --> {{quotation
|quote=writes to the hardware clock or system clock will be denied
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProtectHostname=yes</code>
| <!-- quote --> {{quotation
|quote=changing hostname or domainname via sethostname() and setdomainname() system calls is prevented
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>LockPersonality=yes</code>
| <!-- quote --> {{quotation
|quote=locks down the personality(2) system call
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>MemoryDenyWriteExecute=yes</code>
| <!-- quote --> {{quotation
|quote=writable and executable at the same time
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>RestrictSUIDSGID=yes</code>
| <!-- quote --> {{quotation
|quote=set the set-user-ID (SUID) or set-group-ID (SGID) bits
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>RestrictRealtime=yes</code>
| <!-- quote --> {{quotation
|quote=any attempts to enable realtime scheduling in a process of the unit are refused
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>RestrictNamespaces=yes</code>
| <!-- quote --> {{quotation
|quote=Restricts access to Linux namespace functionality
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>SystemCallArchitectures=native</code>
| <!-- quote --> {{quotation
|quote=disabling non-native ABIs
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>SystemCallFilter=@system-service</code>
| <!-- quote --> {{quotation
|quote=relatively safe basic choice for the majority of system services
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>SystemCallErrorNumber=EPERM</code>
| <!-- quote --> {{quotation
|quote=to return when the system call filter configured with SystemCallFilter= is triggered, instead of terminating the process immediately
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>CapabilityBoundingSet=</code>
| <!-- quote --> {{quotation
|quote=Controls which capabilities to include in the capability bounding set
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>AmbientCapabilities=</code>
| <!-- quote --> {{quotation
|quote=Controls which capabilities to include in the ambient capability set
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>PrivateUsers=yes</code>
| <!-- quote --> {{quotation
|quote=new user namespace
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>PrivateMounts=yes</code>
| <!-- quote --> {{quotation
|quote=private file system (mount) namespace
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>PrivateIPC=yes</code>
| <!-- quote --> {{quotation
|quote=sets up a new IPC namespace
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>PrivatePIDs=yes</code>
| <!-- quote --> {{quotation
|quote=new PID namespace
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProtectProc=invisible</code>
| <!-- quote --> {{quotation
|quote=When set to "invisible" processes owned by other users are hidden from /proc/.
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ProcSubset=pid</code>
| <!-- quote --> {{quotation
|quote=If "pid", all files and directories not directly associated with process management and introspection are made invisible in the /proc/ file system
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>RemoveIPC=yes</code>
| <!-- quote --> {{quotation
|quote=System V and POSIX IPC objects
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>UMask=0077</code>
| <!-- quote --> {{quotation
|quote=file mode creation mask
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>IPAddressDeny=any</code>
| <!-- quote --> {{quotation
|quote=implement an allow-listing IP firewall
}} <ref name=systemd-resource-control>[https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html systemd.resource-control(5)]</ref>
|-

! <!-- directive --> <code>IPAddressAllow=...</code>
| <!-- quote --> {{quotation
|quote=Access is granted
}} <ref name=systemd-resource-control/>
|-

! <!-- directive --> <code>RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6</code>
| <!-- quote --> {{quotation
|quote=address family names to allow-list, such as AF_UNIX, AF_INET or AF_INET6
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>SocketBindDeny=any</code>
| <!-- quote --> {{quotation
|quote=binding is denied when the socket address matches an entry in the SocketBindDeny= list
}} <ref name=systemd-resource-control/>
|-

! <!-- directive --> <code>SocketBindAllow=...</code>
| <!-- quote --> {{quotation
|quote=Binding to a socket is allowed when a socket address matches an entry in the SocketBindAllow= list
}} <ref name=systemd-resource-control/>
|-

! <!-- directive --> <code>ReadWritePaths=...</code>
| <!-- quote --> {{quotation
|quote=Use ReadWritePaths= in order to allow-list specific paths for write access if ProtectSystem=strict is used.
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>ReadOnlyPaths=...</code>
| <!-- quote --> {{quotation
|quote=Paths listed in ReadOnlyPaths= are accessible for reading only, writing will be refused even if the usual file access controls would permit this.
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>InaccessiblePaths=...</code>
| <!-- quote --> {{quotation
|quote=Paths listed in InaccessiblePaths= will be made inaccessible for processes inside the namespace along with everything below them in the file system hierarchy.
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>TemporaryFileSystem=/var:ro</code>
| <!-- quote --> {{quotation
|quote=This is useful to hide files or directories not relevant to the processes invoked by the unit, while necessary files or directories can be still accessed by combining with BindPaths= or BindReadOnlyPaths=:
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>DevicePolicy=closed</code>
| <!-- quote --> {{quotation
|quote=closed in addition, allows access to standard pseudo devices including /dev/null, /dev/zero, /dev/full, /dev/random, and /dev/urandom.
}} <ref name=systemd-resource-control/>
|-

! <!-- directive --> <code>DeviceAllow=...</code>
| <!-- quote --> {{quotation
|quote=Control access to specific device nodes by the executed processes. This functionality is implemented using eBPF filtering.
}} <ref name=systemd-resource-control/>
|-

! <!-- directive --> <code>DynamicUser=yes</code>
| <!-- quote --> {{quotation
|quote=Setting DynamicUser=yes implies ProtectSystem=strict and ProtectHome=read-only.
}} <ref name=dynamic-users>[https://0pointer.net/blog/dynamic-users-with-systemd.html Dynamic Users with systemd]</ref>
|-

! <!-- directive --> <code>StateDirectory=...</code>
| <!-- quote --> {{quotation
|quote=If DynamicUser= is used, the logic for CacheDirectory=, LogsDirectory= and StateDirectory= is slightly altered: the directories are created below /var/cache/private, /var/log/private and /var/lib/private, respectively, which are host directories made inaccessible to unprivileged users, which ensures that access to these directories cannot be gained through dynamic user ID recycling.
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>CacheDirectory=...</code>
| <!-- quote --> {{quotation
|quote=If DynamicUser= is used, the logic for CacheDirectory=, LogsDirectory= and StateDirectory= is slightly altered: the directories are created below /var/cache/private, /var/log/private and /var/lib/private, respectively, which are host directories made inaccessible to unprivileged users, which ensures that access to these directories cannot be gained through dynamic user ID recycling.
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>LogsDirectory=...</code>
| <!-- quote --> {{quotation
|quote=If DynamicUser= is used, the logic for CacheDirectory=, LogsDirectory= and StateDirectory= is slightly altered: the directories are created below /var/cache/private, /var/log/private and /var/lib/private, respectively, which are host directories made inaccessible to unprivileged users, which ensures that access to these directories cannot be gained through dynamic user ID recycling.
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>RuntimeDirectory=...</code>
| <!-- quote --> {{quotation
|quote=If you set it to a directory name of your choice, it will be created below /run when the service is started, and removed in its entirety when it is terminated.
}} <ref name=dynamic-users/>
|-

! <!-- directive --> <code>PrivateNetwork=yes</code>
| <!-- quote --> {{quotation
|quote=turn off network access by the executed process
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>NetworkNamespacePath=...</code>
| <!-- quote --> {{quotation
|quote=Sets a file system path to a Linux network namespace pseudo-file
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>RestrictFileSystems=...</code>
| <!-- quote --> {{quotation
|quote=Restricts the set of filesystems processes of this unit can open files on
}} <ref name=systemd-exec/>
|-

! <!-- directive --> <code>KeyringMode=private</code>
| <!-- quote --> {{quotation
|quote=a new session keyring is allocated when a service process is invoked, and it is not linked up with any user keyring
}} <ref name=systemd-exec/>
|-

|}

= systemd versus non-systemd =
{{project_name_short}} is a systemd-based distribution. {{project_name_short}} is not anti-systemd.

[https://forums.kicksecure.com/t/non-systemd-systemd-development-discussion/766/11 The {{project_name_short}} lead developer isn't convinced by anti-systemd arguments justifying a move to a non-systemd distribution. (Elaborated in forums.)]

Non-systemd is [[unsupported]] because no contributors support this use case.

See also:

* https://without-systemd.org/wiki/index_php/Arguments_against_systemd/
* https://nosystemd.org/

= systemd interface opinion =

{{quotation
|quote=
TODO: expand

The interfaces (the way packages and distributions can place configuration files there) of

* <code>/usr/lib/systemd/system/unit-name.service(.d)</code>;
** ability to easily use capabilities and syscall filters for security hardening
* [https://www.freedesktop.org/software/systemd/man/latest/systemd-tmpfiles-setup.service.html systemd tmpfiles.d] / <code>/usr/lib/tmpfiles.d/</code>;

are excellent.

The [https://systemd.io/BOOT_LOADER_INTERFACE/ The Boot Loader Interface] <code>LoaderSystemToken</code> feature sounds excellent.

Bad things:

* journal log being binary
* adding <code>systemd</code> into the names of tools such as <code>systemd-resolved</code>, <code>systemd-networkd</code> and making these systemd-dependent
* systemd-boot only supporting Intel/AMD64 architecture
|context={{project_name_short}} lead developer opinion.
}}

= Systemd User Environment Variables Configuration =
{{IconSet|h1|1}}

{{CodeSelect|code=
mkdir -p ~/.config/environment.d/
}}

{{IconSet|h1|2}} {{Open File|
filename=~/.config/environment.d/electrumx.conf
}}

{{IconSet|h1|3}} Paste the following contents.

{{CodeSelect|code=
COIN=Bitcoin
DB_DIRECTORY=~/.electrumx
DAEMON_URL=username:password@127.0.0.1
SERVICES=rpC://localhost
PEER_DISCOVERY=self
}}

{{IconSet|h1|4}} Save.

{{IconSet|h1|5}}

{{CodeSelect|code=
systemctl --user daemon-reload
}}

{{IconSet|h1|6}} Done.

The systemd user environment variables configuration has been created and reloaded.

= systemd age API =
* https://forum.qubes-os.org/t/how-much-do-we-gotta-worry-about-this-linux-age-verification-bs/39788/179
* https://forum.qubes-os.org/t/how-much-do-we-gotta-worry-about-this-linux-age-verification-bs/39788/240

= Interesting =
* [https://github.com/jantman/misc-scripts/blob/master/dot_find_cycles.py dot_find_cycles.py - uses Pydot and NetworkX to find cycles in a dot file directed graph.]

= See Also =
* https://forums.kicksecure.com/t/non-systemd-systemd-discussion/766
* https://forums.whonix.org/t/whonix-without-systemd/18426
* [https://forums.whonix.org/t/whonix-without-systemd/18426 Whonix without systemD]

= Footnotes =
<references />
{{Footer}}
[[Category:Documentation]]