Another great sandboxing capability added to systemd, and as easily employed as a single flag: IPAddressDeny=any What I enjoy about systemd is the fact that

Another great sandboxing capability added to systemd, and as easily employed as a single flag: IPAddressDeny=any What I enjoy about systemd is the fact that I can employ capabilities like this with any process on the system using only a line of configuration. FTA: > It's a simple way to lock down distribution/vendor supplied system services by default. For example, if you ship a service that you know never needs to access the network, then simply set IPAddressDeny=any (possibly combined with IPAddressAllow=localhost) for it, and it will live in a very tight networking sand-box it cannot escape from. systemd itself makes use of this for a number of its services by default now. For example, the logging service systemd-journald.service, the login manager systemd-logind or the core-dump processing unit systemd-coredump@.service all have such a rule set out-of-the-box, because we know that neither of these services should be able to access the network, under any circumstances.