ProtectControlGroups setting
The property ProtectControlGroups is a systemd unit setting used for sandboxing. It is available since systemd 232.
Purpose: limit write access to control groups directory structure under /sys/fs/cgroup
Why and when to use ProtectControlGroups
The setting ProtectControlGroups reduces write access to cgroup or Linux control groups. Information about cgroups are normally available under /sys/fs/cgroup. This setting may restrict a process from writing anything to this directory structure.
Generic advice
For most services ProtectControlGroups can be turned on. Only container managers do require write access to the control groups structures.
Example configuration
[Service]
ProtectControlGroups=yes
Values
This setting expects a boolean (yes or no).
- no: do not limit write access - default
- yes: restrict access and mark control group directory structure as read-only
Example to show the current value of ProtectControlGroups for the dmesg service:
systemctl show --property=ProtectControlGroups dmesg.serviceRelated hardening profiles
The systemd unit setting ProtectControlGroups is used in the following hardening profiles.
