systemd Unit Hardening Analyzer

Review a service unit and ordered drop-ins without invoking systemd, loading the host configuration, or contacting a network service.

Unit and drop-ins

Base service unit

Drop-ins in effective order (optional)

Separate multiple drop-ins with a line such as --- DROP-IN: 20-local.conf ---. Blocks are applied in pasted order; systemd itself resolves directory precedence and then lexicographic filenames, so paste that effective order. Scalar last-assignment and documented reset/append behavior are modeled. Set-style directives with multiple positive or negated assignments are preserved as an ordered sequence.

Explicit service needs

Checked means the service may need that access, so the analyzer will not propose blocking it. Uncheck only after confirming the workload requirement. These declarations are review context, not facts inferred from commands.

May need network namespaces or non-local sockets May need physical or special device access May need access to user home directories May need writes outside explicitly listed paths May need JIT or writable executable memory May create Linux namespaces or containers

Dedicated service user (optional)

Known writable paths (space-separated)

Review

Limitations: this is a static checklist, not systemd-analyze security and not a complete score. Directive availability and semantics vary by systemd version, kernel, distribution, service manager mode, executable behavior, and other units. Validate with the target host's manuals and tooling.

Effective reviewed directives

Reviewed `[Service]` settings after pasted-order layering
Directive	Modeled value or assignment sequence	Source

Findings and optional suggestions

Nothing is selected automatically. Check only changes you intend to test.

No override generated.

Testing and rollback

Save the override under the intended unit's .d/ directory and review it line by line.
Run systemd-analyze verify and the target host's systemd-analyze security; resolve version-specific warnings.
Run systemctl daemon-reload, restart in a maintenance window, and exercise health checks, writes, devices, sockets, reload, and shutdown.
Keep an independent administrative session. To roll back, remove or move the new drop-in, run daemon-reload, and restart the service.