#36571 contrib/init: add systemd hardening directives

Adds several systemd sandboxing directives to contrib/init/bitcoind.service, including kernel tunables/logs/modules protection, clock and hostname restrictions, proc visibility controls, namespace restrictions, and an empty capability bounding set. It also restricts socket address families to AF_INET, AF_INET6, AF_UNIX, and AF_NETLINK, applies system call filtering, and updates the ExecStartPre chgrp prefix modifier from ! to + so pre-exec operations retain required privileges under the new capability limits.

Problem: Linux systems deploying bitcoind using the contrib systemd service file lack defense-in-depth isolation, granting the daemon access to kernel tunables, clock settings, unneeded namespaces, and unconstrained syscalls that are unnecessary for normal operation.

Evidence of importance:

• PR description: 'Adds sandboxing options that `bitcoind` doesn't need to be exempt from... Also switches the `ExecStartPre` `chgrp` from "!" to "+", since "!" only lifts `User=`/`Group=`, and the new syscall filter and capability bounding set would block it otherwise.'

Risk of a mistake: low (other). Modifies only an optional example systemd service file in contrib; an overly restrictive directive could cause bitcoind startup or socket communication to fail on systems using that unit.

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

• nothing

Strong

substantive support, no open objection (Hamza1610)

Thread notes: Record initialized with a Tested ACK from Hamza1610 testing systemd security analysis score improvements. / Initial record. Hamza1610 provided a substantive Tested ACK based on systemd security analysis.

Objections, suggestions, and questions: none recorded.

Support:

• Hamza1610 (none) (Tested ACK, 2026-10-21) [both: contrib/init/bitcoind.service]: increases the security of bitcoind, improving systemd security analysis score from 7.7 to 1.6

Participants:

• Hamza1610 (none, support, 1 statements 2026-10-21 to 2026-10-21): Tested ACK, verified security improvement with systemd-analyze

50 lines under test/bench/ci.

• contrib/init/bitcoind.service +49/-1

The short text the ranking pass compares across PRs.

Adds systemd hardening and sandboxing directives to the example bitcoind service unit in contrib/init, including syscall filters, namespace restrictions, an empty capability set, and socket address family limits. Deployments relying on the provided unit currently run without defense-in-depth process sandboxing, leaving unnecessary system interfaces accessible if the daemon process is compromised. The PR also changes the ExecStartPre prefix so permission adjustments on the config directory succeed under the new restrictions.

P3 · new feature

Adds systemd sandboxing directives to reduce daemon attack surface for Linux systemd deployments. While it improves defense-in-depth isolation, it is an optional contrib deployment hardening configuration that can be deferred without affecting core functionality.

Membership: Modifies contrib/init/bitcoind.service, which is an operator deployment configuration script maintained in contrib.

Factors: security/stability 1, bug 0, performance 0, user value 1, leverage 0