I haven't seen any decent articles on this (doesn't mean there aren't any) that mention anything besides most basic flags. Have a gander at the comment I linke

I haven't seen any decent articles on this (doesn't mean there aren't any) that mention anything besides most basic flags. Have a gander at the comment I linked (https://news.ycombinator.com/item?id=29976096 https://news.ycombinator.com/item?id=29976096). --- Probably the easiest way to start is to create your unit file as usual, copy the list from the comment into it, and then run: $ systemd-analyze security unit-name It prints a huge list of suggestions along with a short description of each one. Look up their names in here: $ man systemd.directives and look at the man linked there. Usually it's one of $ man systemd.exec $ man systemd.resource-control I think the starter list should get you 95% there (I use it for most applications with minor variations in paths and flags like MemoryDenyWriteExecute that breaks JIT compilers). --- If you want to keep your configuration as short as possible, the list with the most bang for your buck would look something like this: User=non-root-username # disable privilege escalation through SUID binaries NoNewPrivileges=yes CapabilityBoundingSet= # removes access to /home ProtectHome=yes # makes most paths read-only ProtectSystem=strict # opens read-write access only to paths your application needs ReadWritePaths=/var/lib/foo /var/lib/bar If your application follows FHS and writes stuff to /var/whatever, prefer: RuntimeDirectory=appname StateDirectory=appname CacheDirectory=appname LogsDirectory=appname ConfigurationDirectory=appname instead of RuntimeDirectory=/var/run/appname StateDirectory=/var/lib/appname CacheDirectory=/var/cache/appname LogsDirectory=/var/log/appname ConfigurationDirectory=/etc/appname