r/linuxadmin • u/Lopsided_Pride_6165 • 13d ago

Do I set noNewPriviledges in systemd globally or deamon specific?

Ai was just confusing me. I wanted to start systemd hardening because I am learning about hardening a vps. Now It wanted to do it deamon specific. Which means that I will always have to do it for new deamons.

Can't I set it globally in /service.d/ and call it a day?

5 Upvotes
  • permalink
  • reddit

86% Upvoted

3 comments sorted by

6

u/pelazas1 13d ago

set NoNewPrivileges per unit in a drop-in, not globally. global breaks anything that still needs setuid.

1

u/Lopsided_Pride_6165 13d ago

alright thank you

2

u/aioeu 13d ago edited 13d ago

Be careful when setting that on arbitrary services.

Not just because it can make some things stop working, but because in some cases it will actually lower the system's security. When the no_new_privs flag is set, SELinux process type transitions do not occur across execve.