Re: SystemD ProtectSystem=full still can write File in /etc outside of WorkingDir or WritePath

[Greg Wooledge <greg@wooledge.org>]

On Wed, Jun 25, 2025 at 11:33:02 +0200, Philipp Ewald wrote:
> is it normal that a Service started with systemd still can write files ouitside it working dir?

Depends on the settings in the unit file.  Write restrictions are not
the default, but there are settings you can use which will cause write
restrictions to take effect.

In systemd.exec(5):

    RootDirectory= (does a chroot)

    ProtectHome= (makes /home, /root and /run/user inaccessible)

    ProtectSystem=strict (makes most directories read-only)

    RuntimeDirectory= and friends (adds transient exceptions to
        ProtectSystem=strict)

    ReadWritePaths= (adds nontransient exceptions to ProtectSystem=strict)

    etc.