SystemCallArchitectures setting
The property SystemCallArchitectures is a systemd unit setting used for sandboxing. It is available since systemd 209.
Purpose: restrict the subset of CPU instructions
Why and when to use SystemCallArchitectures
Usually Linux user processes talk via interface with a facility of the operating system, a so-called ABI . For common instructions this is done using a syscall. When a system supports multiple ABIs, it may be useful to restrict the set that can be used to prevent circumventing a setting like SystemCallFilter.
Generic advice
For most systemd units, the setting SystemCallArchitectures=native is advised to restrict access one set of CPU instructions.
Related hardening profiles
The systemd unit setting SystemCallArchitectures is used in the following hardening profiles.
