I think it would be nice to modify the service file to run as non-root: [Service] ... User=vnstat CapabilityBoundingSet= Untested. Also it would be required to change the ownership of files in /var/lib/vnstat, but this should be done by the install script.