I've been looking into hardening systemd and I'm curious why so many units are not hardened by default. Like why isn't it a standard practice to harden systemd units? Do the exposed parts shown in the output of `systemd analyze security <unit>` have that much of an impact on the overall security of the unit? I would think these exposure points would add up to a vulnerability that shouldn't be neglected.
https://blog.sergeantbiggs.net/posts/hardening-applications-with-systemd/
SergeantBiggs Blog · Hardening Applications with systemdBecause we live in the day and age where the new gods have taken over Linux, it’s a good idea to familiarize ourselves with their rituals. Some of them might seem strange to us, but some of them are actually very nice features. One of the features I really like about systemd are the built-in hardening capabilities.
The built-in options for hardening are quite extensive, and can best be compared to something like firejail. They both have similar capabilities, but firejail focuses more on desktop applications, whereas systemd hardening applies to systemd units. The hardening options are configured in the units service file, in the [Service] section.
![The InitWare Suite of Middleware allows you to manage services and system resources as logical entities called units. Its main component is a service management ("init") system. - InitWar...](https://files.mastodon.green/cache/preview_cards/images/000/068/524/original/4c09f744a06fed05.png "The InitWare Suite of Middleware allows you to manage services and system resources as logical entities called units. Its main component is a service management ("init") system. - InitWar...")
Lou Lüeder 
