hardening

Your Daemons Are Over-Privileged: The systemd Sandboxing Playbook

ProtectSystem, PrivateTmp, NoNewPrivileges, and the scoring tool that grades your work — lock down any systemd service with a drop-in file and fifteen minutes.