{
 "number": 36571,
 "input_hash": "aaae7117f3d10331",
 "model": "ledger",
 "prompt_hash": null,
 "created": "2026-10-22T01:16:57+00:00",
 "result": {
  "summary": "Adds several systemd sandboxing directives to contrib/init/bitcoind.service, including kernel tunables/logs/modules protection, clock and hostname restrictions, proc visibility controls, namespace restrictions, and an empty capability bounding set. It also restricts socket address families to AF_INET, AF_INET6, AF_UNIX, and AF_NETLINK, applies system call filtering, and updates the ExecStartPre chgrp prefix modifier from ! to + so pre-exec operations retain required privileges under the new capability limits.",
  "problem": "Linux systems deploying bitcoind using the contrib systemd service file lack defense-in-depth isolation, granting the daemon access to kernel tunables, clock settings, unneeded namespaces, and unconstrained syscalls that are unnecessary for normal operation.",
  "card": "Adds systemd hardening and sandboxing directives to the example bitcoind service unit in contrib/init, including syscall filters, namespace restrictions, an empty capability set, and socket address family limits. Deployments relying on the provided unit currently run without defense-in-depth process sandboxing, leaving unnecessary system interfaces accessible if the daemon process is compromised. The PR also changes the ExecStartPre prefix so permission adjustments on the config directory succeed under the new restrictions.",
  "evidence": [
   "PR description: 'Adds sandboxing options that `bitcoind` doesn't need to be exempt from... Also switches the `ExecStartPre` `chgrp` from \"!\" to \"+\", since \"!\" only lifts `User=`/`Group=`, and the new syscall filter and capability bounding set would block it otherwise.'"
  ],
  "scope_notes": "",
  "changed_since_previous": "",
  "thread": {
   "last_event_at": "2026-10-21T13:42:19Z",
   "events": 1,
   "head_sha": "ad2600eb3e44f3a2d164d1f054a922e9f798c18d",
   "schema_floor": 2,
   "schema": 2
  },
  "waiting_on": [
   {
    "at": null,
    "id": "",
    "on": "nothing",
    "url": null,
    "what": ""
   }
  ],
  "risk": {
   "level": "low",
   "touches": [
    "other"
   ],
   "why": "Modifies only an optional example systemd service file in contrib; an overly restrictive directive could cause bitcoind startup or socket communication to fail on systems using that unit."
  },
  "discussion": {
   "author_status": "last statement processed 2026-10-21",
   "open_concerns": [],
   "resolved_concerns": []
  },
  "reviewability": {
   "state": "Ready",
   "label": "Ready",
   "reason": "Nothing known that would invalidate a review now."
  },
  "agreement": {
   "state": "Strong",
   "summary": "Strong: substantive support, no open objection (Hamza1610)",
   "reason": "Record initialized with a Tested ACK from Hamza1610 testing systemd security analysis score improvements. / Initial record. Hamza1610 provided a substantive Tested ACK based on systemd security analysis.",
   "evidence": [
    "Hamza1610: Tested ACK \u2014 increases the security of bitcoind, improving systemd security analysis score from 7.7 to 1.6"
   ],
   "objections": [],
   "support": [
    {
     "reviewer": "Hamza1610",
     "reason": "increases the security of bitcoind, improving systemd security analysis score from 7.7 to 1.6",
     "substantive": true,
     "verdict": "Tested ACK",
     "id": "rc:4337564574",
     "url": "https://github.com/bitcoin/bitcoin/pull/36571#discussion_r4337564574",
     "at": "2026-10-21",
     "association": "NONE",
     "evidence": "both",
     "areas": [
      "contrib/init/bitcoind.service"
     ]
    }
   ],
   "participants": [
    {
     "login": "Hamza1610",
     "stance": "support",
     "note": "Tested ACK, verified security improvement with systemd-analyze",
     "association": "NONE",
     "comments": 1,
     "first": "2026-10-21",
     "last": "2026-10-21"
    }
   ],
   "derivation": "substantive support, no open objection (Hamza1610)",
   "model_state": null,
   "corrections": [],
   "notes": "Record initialized with a Tested ACK from Hamza1610 testing systemd security analysis score improvements. / Initial record. Hamza1610 provided a substantive Tested ACK based on systemd security analysis."
  },
  "dependencies": {
   "depends_on": [],
   "enables": []
  },
  "categories": [
   {
    "name": "tools",
    "member": true,
    "evidence": "Modifies contrib/init/bitcoind.service, which is an operator deployment configuration script maintained in contrib.",
    "band": "P3",
    "reason_tag": "new feature",
    "score": 0.35,
    "factors": {
     "bug_severity": 0,
     "leverage": 0,
     "performance": 0,
     "security_stability": 1,
     "user_value": 1
    },
    "rationale": "Adds systemd sandboxing directives to reduce daemon attack surface for Linux systemd deployments. While it improves defense-in-depth isolation, it is an optional contrib deployment hardening configuration that can be deferred without affecting core functionality."
   },
   {
    "name": "utils",
    "member": false,
    "evidence": "Modifies a systemd unit configuration file in contrib/init rather than the node's internal C++ utilities, arguments, or startup code.",
    "band": "Unranked",
    "reason_tag": "cleanup",
    "score": 0.0,
    "factors": {
     "bug_severity": 0,
     "leverage": 0,
     "performance": 0,
     "security_stability": 1,
     "user_value": 1
    },
    "rationale": "Candidate category matched on keywords ('init', 'lock'); this PR does not touch shared core node utilities or internal startup and shutdown sequencing."
   }
  ],
  "confidence": "high",
  "uncertainties": [],
  "needs": []
 },
 "cost_usd": 0.0,
 "source": {
  "record": "2026-10-22T01:16:57+00:00",
  "code": "2026-10-21T01:23:18+00:00",
  "judgments": 2
 }
}