« Back to Settings for systemd units

RestrictNamespaces setting

The property RestrictNamespaces is a systemd unit setting used for sandboxing. It is available since systemd 233.

Purpose: control allow namespaces

Why and when to use RestrictNamespaces

The setting RestrictNamespaces aims to restrict what namespaces can be used. Namespaces create an abstraction layer around a global resource, such as a filesystem.

Relevant namespaces include:

  • cgroup
  • ipc
  • mnt
  • net
  • pid
  • user
  • uts

When using this option, the default is that it is used as an allow-list and define what namespaces only can be used.

Settings

This setting may be used once or multiple times. When it is used multiple times, it adds to the list (logical OR). Lines that have a value with tilde (~) prepended, will turn it into AND, blocking the relevant items.

To create a deny-list, add only those namespaces to block by prepending the list with a tilde (~).

When this setting is not configured, there are no restrictions when it comes to namespaces that a service can use.

Caveats

This setting only works on:

  • x86, x86-64
  • mips, mips-le, mips64, mips64-le, mips64-n32, mips64-le-n32
  • ppc64, ppc64-le
  • s390, s390x

Generic advice

Using this option depends really on the type of service and if a restriction is needed. Normally namespaces may already help shielding a service from a global resource. So this option should be used with care.

Values

Systemd unit setting RestrictNamespaces expects a boolean (yes/no or true/false) or string value.

Values for systemd unit setting RestrictNamespaces
ValueIntended actionAvailable since
systemd version
[LIST OF NAMESPACESdefine namespaces that are allowed or denied

Example to show the current value of RestrictNamespaces for the ssh service:

systemctl show --property=RestrictNamespaces ssh.service

Related hardening profiles

The systemd unit setting RestrictNamespaces is used in the following hardening profiles.

Frequently Asked Questions

How to use systemctl edit?

Run systemctl with the 'edit' subcommand and service.

systemctl edit UNIT.service

See full answer at How to use systemctl edit to change a service?

Related articles

Like to learn more? Here is a list of articles within the same category or having similar tags.

Feedback

Small picture of Michael Boelen

This article has been written by our Linux security expert Michael Boelen. With focus on creating high-quality articles and relevant examples, he wants to improve the field of Linux security. No more web full of copy-pasted blog posts.

Discovered outdated information or have a question? Share your thoughts. Thanks for your contribution!

Mastodon icon