| # SPDX-License-Identifier: GPL-2.0-or-later | |
| # | |
| # Copyright (C) 2026 Oracle. All Rights Reserved. | |
| # Author: Darrick J. Wong <djwong@kernel.org> | |
| [Unit] | |
| Description=null Sample Fuse Service | |
| # Don't leave failed units behind, systemd does not clean them up! | |
| CollectMode=inactive-or-failed | |
| [Service] | |
| Type=exec | |
| ExecStart=/path/to/null | |
| # Try to capture core dumps | |
| LimitCORE=infinity | |
| SyslogIdentifier=%N | |
| # No realtime CPU scheduling | |
| RestrictRealtime=true | |
| # Don't let us see anything in the regular system, and don't run as root | |
| DynamicUser=true | |
| ProtectSystem=strict | |
| ProtectHome=true | |
| PrivateTmp=true | |
| PrivateDevices=true | |
| PrivateUsers=true | |
| # No network access | |
| PrivateNetwork=true | |
| ProtectHostname=true | |
| RestrictAddressFamilies=none | |
| IPAddressDeny=any | |
| # Don't let the program mess with the kernel configuration at all | |
| ProtectKernelLogs=true | |
| ProtectKernelModules=true | |
| ProtectKernelTunables=true | |
| ProtectControlGroups=true | |
| ProtectProc=invisible | |
| RestrictNamespaces=true | |
| RestrictFileSystems= | |
| # Hide everything in /proc, even /proc/mounts | |
| ProcSubset=pid | |
| # Only allow the default personality Linux | |
| LockPersonality=true | |
| # No writable memory pages | |
| MemoryDenyWriteExecute=true | |
| # Don't let our mounts leak out to the host | |
| PrivateMounts=true | |
| # Restrict system calls to the native arch and only enough to get things going | |
| SystemCallArchitectures=native | |
| SystemCallFilter=@system-service | |
| SystemCallFilter=~@privileged | |
| SystemCallFilter=~@resources | |
| SystemCallFilter=~@clock | |
| SystemCallFilter=~@cpu-emulation | |
| SystemCallFilter=~@debug | |
| SystemCallFilter=~@module | |
| SystemCallFilter=~@reboot | |
| SystemCallFilter=~@swap | |
| SystemCallFilter=~@mount | |
| # libfuse io_uring wants to pin cores and memory | |
| SystemCallFilter=mbind | |
| SystemCallFilter=sched_setaffinity | |
| # Leave a breadcrumb if we get whacked by the system call filter | |
| SystemCallErrorNumber=EL3RST | |
| # Log to the kernel dmesg, just like an in-kernel filesystem driver | |
| StandardOutput=append:/dev/ttyprintk | |
| StandardError=append:/dev/ttyprintk | |
| # Run with no capabilities at all | |
| CapabilityBoundingSet= | |
| AmbientCapabilities= | |
| NoNewPrivileges=true | |
| # We don't create files | |
| UMask=7777 | |
| # No access to hardware /dev files at all | |
| ProtectClock=true | |
| DevicePolicy=closed | |
| # Don't mess with set[ug]id anything. | |
| RestrictSUIDSGID=true | |
| # Don't let OOM kills of processes in this containment group kill the whole | |
| # service, because we don't want filesystem drivers to go down. | |
| OOMPolicy=continue | |
| OOMScoreAdjust=-1000 |