Home Directory

ProtectHome setting

capabilities
configuration
home directory
linux
systemd

Restrict systemd units to access data in home directories with the unit setting ProtectHome.

Summary

Why and when to use ProtectHome

The setting ProtectHome aims to protect home directories. These three paths are included:

/home
/root
/run/user

Settings

The default no will not restrict access to the home directories. Using yes will active full protection, not allowing access.

The value read-only will make the paths read-only, so no data can be written to it.

With tmpfs a temporary file system is being used, also read-only, yet it hides the actual home directories. It will still allow access to the actual directories when using BindPaths or BindReadOnlyPaths. For rare situations this might be useful to protect the home directories, while still allowing some very specific access.