« Back to Settings for systemd units

ProtectHome setting

This systemd unit setting was added since systemd 214.

Purpose: define what level of access is possible to home directories

Why and when to use ProtectHome

The setting ProtectHome aims to protect home directories. These three paths are included:

  • /home
  • /root
  • /run/user


The default no will not restrict access to the home directories. Using yes will active full protection, not allowing access.

The value read-only will make the paths read-only, so no data can be written to it.

With tmpfs a temporary file system is being used, also read-only, yet it hides the actual home directories. It will still allow access to the actual directories when using BindPaths or BindReadOnlyPaths. For rare situations this might be useful to protect the home directories, while still allowing some very specific access.

Generic advice

For longer running services that do not need to access home directories, use ProtectHome=yes.


  • no: normal access allowed to home directories - default
  • read-only: grant access to home directories, but only to read (no write)
  • tmpfs: similar to read-only, with the exception that a temporary file system is mounted. It hides the home directories.
  • yes: no access to home directories

Example to show the current value of ProtectHome for the dmesg service:

systemctl show --property=ProtectHome dmesg.service


Small picture of Michael Boelen

This article has been written by our Linux security expert Michael Boelen. With focus on creating high-quality articles and relevant examples, he wants to improve the field of Linux security. No more web full of copy-pasted blog posts.

Discovered outdated information or have a question? Share your thoughts. Thanks for your contribution!

Mastodon icon