| # SPDX-License-Identifier: GPL-2.0-or-later |
| # |
| # Copyright (C) 2026 Oracle. All Rights Reserved. |
| # Author: Darrick J. Wong <djwong@kernel.org> |
| [Unit] |
| Description=null Sample Fuse Service |
| |
| # Don't leave failed units behind, systemd does not clean them up! |
| CollectMode=inactive-or-failed |
| |
| [Service] |
| Type=exec |
| ExecStart=/path/to/null |
| |
| # Try to capture core dumps |
| LimitCORE=infinity |
| |
| SyslogIdentifier=%N |
| |
| # No realtime CPU scheduling |
| RestrictRealtime=true |
| |
| # Don't let us see anything in the regular system, and don't run as root |
| DynamicUser=true |
| ProtectSystem=strict |
| ProtectHome=true |
| PrivateTmp=true |
| PrivateDevices=true |
| PrivateUsers=true |
| |
| # No network access |
| PrivateNetwork=true |
| ProtectHostname=true |
| RestrictAddressFamilies=none |
| IPAddressDeny=any |
| |
| # Don't let the program mess with the kernel configuration at all |
| ProtectKernelLogs=true |
| ProtectKernelModules=true |
| ProtectKernelTunables=true |
| ProtectControlGroups=true |
| ProtectProc=invisible |
| RestrictNamespaces=true |
| RestrictFileSystems= |
| |
| # Hide everything in /proc, even /proc/mounts |
| ProcSubset=pid |
| |
| # Only allow the default personality Linux |
| LockPersonality=true |
| |
| # No writable memory pages |
| MemoryDenyWriteExecute=true |
| |
| # Don't let our mounts leak out to the host |
| PrivateMounts=true |
| |
| # Restrict system calls to the native arch and only enough to get things going |
| SystemCallArchitectures=native |
| SystemCallFilter=@system-service |
| SystemCallFilter=~@privileged |
| SystemCallFilter=~@resources |
| |
| SystemCallFilter=~@clock |
| SystemCallFilter=~@cpu-emulation |
| SystemCallFilter=~@debug |
| SystemCallFilter=~@module |
| SystemCallFilter=~@reboot |
| SystemCallFilter=~@swap |
| |
| SystemCallFilter=~@mount |
| |
| # libfuse io_uring wants to pin cores and memory |
| SystemCallFilter=mbind |
| SystemCallFilter=sched_setaffinity |
| |
| # Leave a breadcrumb if we get whacked by the system call filter |
| SystemCallErrorNumber=EL3RST |
| |
| # Log to the kernel dmesg, just like an in-kernel filesystem driver |
| StandardOutput=append:/dev/ttyprintk |
| StandardError=append:/dev/ttyprintk |
| |
| # Run with no capabilities at all |
| CapabilityBoundingSet= |
| AmbientCapabilities= |
| NoNewPrivileges=true |
| |
| # We don't create files |
| UMask=7777 |
| |
| # No access to hardware /dev files at all |
| ProtectClock=true |
| DevicePolicy=closed |
| |
| # Don't mess with set[ug]id anything. |
| RestrictSUIDSGID=true |
| |
| # Don't let OOM kills of processes in this containment group kill the whole |
| # service, because we don't want filesystem drivers to go down. |
| OOMPolicy=continue |
| OOMScoreAdjust=-1000 |
