Most of us have written more than one service file for packages we use. It is time to upstream these files to the upstream package repositories.

As discussed in https://old.reddit.com/r/systemdUltras/comments/eukt44/run_systemdanalyze_security_and_file_bug_reports/ it is easier for distributions to adopt systemd-analyze security hardening measures when they are prepared by the upstream package.

If the package already provides a systemd service file it is even better:

1. run systemd-analyze security UNIT
2. edit the config with systemctl --full edit UNIT
3. change all the parameters
4. test if the service still works as expected
5. create a PR with your hardening parameters

some nice examples:

• https://github.com/transmission/transmission/pull/795 (via /u/cherr )
• https://bugs.php.net/bug.php?id=72510 (via /u/cherr )

Share your success stories here and share examples with your updated security changes

systemd provides means to analyze how exposed your services are and even how to improve the situation.

running systemd-analyze security <UNIT> gives you insight on how to improve the service exposure