Not a generic INI validator: dependency ≠ ordering, ExecStart ≠ shell, [Install] ≠ runtime. Data never leaves the client.
Loading…
SD_HARDEN_NONEWPRIVILEGES[Service]Without NoNewPrivileges the process may escalate via setuid. Often safe to enable.
NoNewPrivileges=yes
NoNewPrivileges=yes
SD_DIRECTIVE_WRONG_SECTION[Service]L13Directive in an unusual section for .service/.timer. Check placement.
StartLimitIntervalSec=60
SD_DIRECTIVE_WRONG_SECTION[Service]L14Directive in an unusual section for .service/.timer. Check placement.
StartLimitBurst=5
SD_DEP_NE_ORDER[Unit]Requires/Wants declare a dependency (whether a unit is needed); Before/After only order starts. One does not replace the other.
SD_DROPIN_UNKNOWNAnalysis sees only the pasted text. Host drop-ins from *.d/ and `systemctl cat` are not loaded.
SD_INSTALL_NOT_RUNTIME[Install]WantedBy/RequiredBy create symlinks on enable. For start ordering see After=/Requires= in [Unit].
WantedBy=multi-user.target
SD_HARDEN_PRIVATETMP[Service]PrivateTmp=yes isolates /tmp. Not universal (shared tmp may be required) — context matters.
PrivateTmp=yes
PrivateTmp=yes
SD_HARDEN_PROTECTHOME[Service]ProtectHome=yes|read-only|tmpfs hides /home. Skip for user units that need home access.
ProtectHome=yes
ProtectHome=yes
SD_HARDEN_PROTECTSYSTEM[Service]ProtectSystem=strict|full|true limits writes to /, /usr, /boot. Tune per service.
ProtectSystem=strict
ProtectSystem=strict
SD_HARDEN_SYSCALL_FILTER[Service]A seccomp filter (@system-service, @privileged, …) reduces attack surface. Do not copy blindly.
SystemCallFilter=@system-service
SystemCallFilter=@system-service SystemCallErrorNumber=EPERM
SD_NETWORK_ONLINE[Unit]L4Correct “network online” target if the host has NetworkManager-wait-online / systemd-networkd-wait-online.
Wants=network-online.target