{
 "number": 36571,
 "repo": "bitcoin/bitcoin",
 "url": "https://github.com/bitcoin/bitcoin/pull/36571",
 "title": "contrib/init: add systemd hardening directives",
 "author": "jpk68",
 "author_association": "CONTRIBUTOR",
 "created_at": "2026-10-19T00:35:34Z",
 "updated_at": "2026-10-21T14:05:09Z",
 "description_hash": "d1f98579c7afb4a3",
 "age_days": 14,
 "draft": false,
 "labels": [],
 "milestone": null,
 "base": "master",
 "head_sha": "ad2600eb3e44f3a2d164d1f054a922e9f798c18d",
 "head_ref": "harden-systemd",
 "head_repo": "jpk68/bitcoin",
 "head_history": [],
 "additions": 49,
 "deletions": 1,
 "changed_files": 1,
 "commit_count": 1,
 "size_bucket": "S",
 "mergeable_state": "clean",
 "bot": {
  "drahtbot": {
   "present": true,
   "reviews": {},
   "conflicts": []
  }
 },
 "acks_parsed": {},
 "acks_tally": {
  "ack": 0,
  "stale_ack": 0,
  "concept_ack": 0,
  "approach_ack": 0,
  "nack": 0,
  "concept_nack": 0,
  "approach_nack": 0
 },
 "reviews": {
  "approved": 0,
  "changes_requested": 0,
  "distinct_reviewers": [
   "Hamza1610"
  ]
 },
 "signals": {
  "needs_rebase": false,
  "ci_failed": false,
  "mergeable_state": "clean",
  "last_author_activity": "2026-10-19T00:26:19Z",
  "last_reviewer_activity": "2026-10-21T13:42:19Z",
  "last_reviewer": "Hamza1610",
  "author_silent_days": 14,
  "waiting_on_author_days": 11,
  "days_since_update": 11
 },
 "refs": {
  "mentioned": [],
  "depends_on": [],
  "fixes": [],
  "linked_issues": [],
  "references": [],
  "conflicts": []
 },
 "stack": {
  "shares_commits_with": [],
  "based_on": [],
  "base_for": []
 },
 "review_paths": [
  "contrib/init/bitcoind.service"
 ],
 "body": "Adds sandboxing options that `bitcoind` doesn't need to be exempt from, namely kernel/clock/hostname protection, namespace, realtime and SUID restrictions, a socket address family allowlist, and a system call filter and empty capability bounding set.\n\nAlso switches the `ExecStartPre` `chgrp` from \"!\" to \"+\", since \"!\" only lifts `User=`/`Group=`, and the new syscall filter and capability bounding set would block it otherwise.",
 "commits": [
  {
   "sha": "ad2600eb3e44f3a2d164d1f054a922e9f798c18d",
   "date": "2026-10-19T00:26:19Z",
   "message": "contrib/init: add systemd hardening directives"
  }
 ],
 "timeline": [
  {
   "t": "2026-10-21T13:42:19Z",
   "kind": "review_comment",
   "who": "Hamza1610",
   "assoc": "NONE",
   "path": "contrib/init/bitcoind.service",
   "commit": "ad2600eb3e44f3a2d164d1f054a922e9f798c18d",
   "in_reply_to": null,
   "text": "Tested ACK ad2600eb3e44f3a2d164d1f054a922e9f798c18d\nI think you hit it, by changing the sandbox restriction and to a symtemd manager privileges, this increase the security of the bitcoind. I ran the security analysis using `systemd-analyze security --offline=true contrib/init/bitcoind.service` and the result was credible, moving from 7.7 to 1.6 score:\nFrom master\n[quoted text omitted]\n\nFrom this PR\n[quoted text omitted]",
   "id": "rc:4337564574",
   "url": "https://github.com/bitcoin/bitcoin/pull/36571#discussion_r4337564574",
   "hash": "812d202c7ff0c42c",
   "edited": "2026-10-21T13:59:29Z"
  }
 ],
 "labels_log": [],
 "state_log": [],
 "text_chars": 946,
 "text_tokens_estimate": 236,
 "changed_paths": [
  "contrib/init/bitcoind.service"
 ],
 "files": [
  {
   "path": "contrib/init/bitcoind.service",
   "add": 49,
   "del": 1
  }
 ],
 "test_lines": 50,
 "git": {
  "head": "ad2600eb3e44f3a2d164d1f054a922e9f798c18d",
  "head_matches_backup": true,
  "base": "924f4c4ac78b0cd3b917c694f42c0651a6f3003a",
  "patch_id": "feda470ad80c6b6f",
  "commits": [
   {
    "sha": "ad2600eb3e",
    "subject": "contrib/init: add systemd hardening directives",
    "files": 1,
    "add": 49,
    "del": 1
   }
  ],
  "patch_truncated": false
 },
 "patch_id": "feda470ad80c6b6f",
 "input_hash": "a56c49eb37b5fa7d",
 "extracted_at": "2026-11-02T01:09:49+00:00"
}