security: restrict abis in bitcoind.service

It's recommended to restrict the possible application binary interfaces that can be used when setting `MemoryDenyWriteExecute=true` to ensure it cannot be circumvented.
AreaLayer · Aug 24, 2023 · 0244416 · 0244416
1 parent 5ce200d
commit 0244416
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/contrib/init/bitcoind.service b/contrib/init/bitcoind.service
@@ -81,5 +81,8 @@ PrivateDevices=true
 # Deny the creation of writable and executable memory mappings.
 MemoryDenyWriteExecute=true
 
+# Restrict ABIs to help ensure MemoryDenyWriteExecute is enforced
+SystemCallArchitectures=native
+
 [Install]
 WantedBy=multi-user.target