ProtectHome

systemd ships with powerful built-in hardening features — ProtectSystem, ProtectHome, and PrivateTmp — that isolate services at the kernel level with no extra software required. This guide covers practical configuration steps and how to verify effectiveness with systemd-analyze security.