CME-710

DynamicUser (systemd)

Isolate OS/Kernel Unquantified evidence Preventive

Description

systemd dynamically allocates a unique UID/GID per service instance. No persistent user account exists; each service restart gets a fresh identity, preventing cross-service data access.

CVSS Vector Impacts

Metric	Transition	Rationale
Scope (S)	C → U	Service runs with ephemeral identity that owns no persistent files

CWE Relationships

CWE-269

Verification

Check DynamicUser setting

$ systemctl show <service> -p DynamicUser
# Expected: DynamicUser=yes

Platform: linux

$ grep -r 'DynamicUser=yes' /etc/systemd/system/<service>.service /etc/systemd/system/<service>.service.d/ /usr/lib/systemd/system/<service>.service 2>/dev/null | wc -l
# Expected: >=1

Platform: linux

$ systemctl show <service> -p ProtectSystem,PrivateTmp,RemoveIPC
# Expected: ProtectSystem=strict; PrivateTmp=yes; RemoveIPC=yes (DynamicUser implies these)

Platform: linux

Remediation

linux systemd drop-in with DynamicUser=yes


mkdir -p /etc/systemd/system/<service>.service.d
printf '[Service]\nDynamicUser=yes\n' > /etc/systemd/system/<service>.service.d/dynamic-user.conf
systemctl daemon-reload
systemctl restart <service>