systemd_options.md

Supported systemd options

• CapabilityBoundingSet

  • dynamic blacklisting

• IPAddressDeny

  • any
  • to support this option, other options may be dynamically enabled:
    • IPAddressAllow

• InaccessiblePaths

  • dynamic path blacklisting
  • to support this option, other options may be dynamically enabled:
    • PrivateMounts
    • TemporaryFileSystem
    • BindReadOnlyPaths
    • BindPaths

• LockPersonality

  • true

• MemoryDenyWriteExecute

  • true

• NoExecPaths

  • dynamic path blacklisting
  • to support this option, other options may be dynamically enabled:
    • PrivateMounts
    • ExecPaths

• PrivateDevices

  • true

• PrivateMounts

  • true

• PrivateNetwork

  • true

• PrivateTmp

  • disconnected

• ProcSubset

  • pid

• ProtectClock

  • true

• ProtectControlGroups

  • true

• ProtectHome

  • tmpfs
  • read-only
  • true

• ProtectKernelLogs

  • true

• ProtectKernelModules

  • true

• ProtectKernelTunables

  • true

• ProtectProc

  • ptraceable

• ProtectSystem

  • true
  • full
  • strict

• ReadOnlyPaths

  • dynamic path blacklisting
  • to support this option, other options may be dynamically enabled:
    • PrivateMounts
    • ReadWritePaths

• RestrictAddressFamilies

  • dynamic whitelisting

• RestrictRealtime

  • true

• SocketBindDeny

  • dynamic blacklisting

• SystemCallArchitectures

  • native

• SystemCallFilter

  • dynamic blacklisting