systemd Unit Security

systemd is a tool for among other things, managing services. This is primarily done by users through unit files which describe where to find a service, what to run, the service's environment block, and more. Part of this is describing its security configuration. These features use features of the Linux kernel, such as cgroups, namespaces, and capabilities in order to help restrict the attack surface of well meaning services. This tool scores services (in the same way systemd does) on a scale from 0 to 10, where 0 is the least exposed, and 10 is the most exposed. As of systemd 253, the default configuration has an exposure level of 9.6.

It is worth noting that a high score does not inherently mean that a service is unsafe, rather that it does not use many of the features systemd provides to help increase security. However, a service that has many of these features enabled can be safer and can have many restrictions enforced by the operating system (which can help reduce the impact of security issues), as well as be able to run services with slightly higher privileges than unprivileged counterparts, but without running as root.

Your systemd Unit Configuration

Scale

systemd gives a color, a small text word, and an emoji describing, at a glance, the security profile of a systemd service. Here is a table with all of the different values.