« Back to Settings for systemd units

MemoryDenyWriteExecute setting

The property MemoryDenyWriteExecute is a systemd unit setting used for sandboxing. It is available since systemd 231.

Purpose: block creation or alteration of memory segments to become writable and executable as well

Why and when to use MemoryDenyWriteExecute

The setting MemoryDenyWriteExecute will block the creation or alteration of a memory segment to become writable and executable as well. By enabling this limitation, it will increase the bar software exploits to change running code dynamically.

Usage

[Service]
MemoryDenyWriteExecute=yes
InaccessiblePaths=/dev/shm
SystemCallFilter=~memfd_create

Caveats

To prevent circumvention of this setting, access to /dev/shm and the syscall memfd_create should be blocked as well.

Generic advice

For most common services this option can be implemented and will increase the security of a service. That is, if used together with InaccessiblePaths and SystemCallFilter.

Values

Systemd unit setting MemoryDenyWriteExecute expects a boolean (yes/no or true/false) or string value.

Values for systemd unit setting MemoryDenyWriteExecute
ValueIntended actionAvailable since
systemd version
nonormal functionality allowed - default
yescreation and alteration of memory segments to become writable and executable is not allowed

Example to show the current value of MemoryDenyWriteExecute for the ssh service:

systemctl show --property=MemoryDenyWriteExecute ssh.service

Related hardening profiles

The systemd unit setting MemoryDenyWriteExecute is used in the following hardening profiles.

Frequently Asked Questions

How to use systemctl edit?

Run systemctl with the 'edit' subcommand and service.

systemctl edit UNIT.service

See full answer at How to use systemctl edit to change a service?

Related articles

Like to learn more? Here is a list of articles within the same category or having similar tags.

Feedback

Small picture of Michael Boelen

This article has been written by our Linux security expert Michael Boelen. With focus on creating high-quality articles and relevant examples, he wants to improve the field of Linux security. No more web full of copy-pasted blog posts.

Discovered outdated information or have a question? Share your thoughts. Thanks for your contribution!

Mastodon icon