There are certainly some mitigating controls that make this a better story than what Windows implemented. The malicious actor may have indirect access, or acce

There are certainly some mitigating controls that make this a better story than what Windows implemented. The malicious actor may have indirect access, or access via a web service that might give them limited ability to call a command or file. So in those cases, this framework can potentially make the complexity level of a vulnerability lower and the overall risk higher. For now, I just limit binfmt and debugfs mounts so that regular users (especially service accounts) can't even access them. I think this only partially reduces the risk, since systemd acts as a proxy to binfmt. SELinux also reduce some risks, but so many people disable it that I can't factor that in. /etc/fstab: binfmt /proc/sys/fs/binfmt_misc binfmt_misc defaults,rw,noatime,mode=00500 0 0 nodev /sys/kernel/debug debugfs defaults,noatime,mode=00500 0 0 There is probably a better way to disable this behavior, but I am working around many new features of systemd that are blurring the line between desktops and servers. The above also fixed several race conditions in systemd on hyper-v VM's that are considered low priority bugs.