CME-709

systemd Service Sandboxing (PrivateDevices, PrivateTmp, ProtectSystem)

Isolate OS/Kernel Unquantified evidence Preventive

Description

systemd unit directives that sandbox services: PrivateDevices removes device access, PrivateTmp isolates /tmp, ProtectSystem=strict makes / read-only, ProtectHome=true hides /home.

CVSS Vector Impacts

Metric	Transition	Rationale
Scope (S)	C → U	Service isolated from host filesystem, devices, and user data
Confidentiality (C)	H → L	Cannot access user home directories or arbitrary devices
Integrity (I)	H → L	Cannot modify system files outside designated directories

CWE Relationships

CWE-269 CWE-284 CWE-367 CWE-362

Verification

Check systemd unit for sandbox directives

$ systemctl show <service> -p ProtectSystem,PrivateTmp,PrivateDevices,ProtectHome
# Expected: ProtectSystem=strict

Platform: linux

Remediation

linux systemd drop-in with ProtectSystem, PrivateTmp, PrivateDevices, and ProtectHome


mkdir -p /etc/systemd/system/<service>.service.d
printf '[Service]\nProtectSystem=strict\nPrivateTmp=true\nPrivateDevices=true\nProtectHome=true\nNoNewPrivileges=true\nProtectKernelTunables=true\nProtectKernelModules=true\n' > /etc/systemd/system/<service>.service.d/sandbox.conf
systemctl daemon-reload
systemctl restart <service>