Sandbox a systemd Service Without Breaking It

A batch worker on this box runs as root with no sandboxing at all. If it is ever compromised, whoever owns it owns the machine. Confine it with systemd's sandboxing directives, and measure the result instead of guessing.

/root/case/assignment.env names the service, its unit file, the highest overall exposure you may leave (EXPOSURE_MAX), its state directory, and one more duty the sandbox must not break. All of these differ per session, and /root/case/brief.txt has the details.

1. Put the hardening in a drop-in under /etc/systemd/system/SERVICE.service.d/. The unit file itself stays exactly as it is.

2. Get systemd-analyze security --offline=true SERVICE.service to report an overall exposure at or under EXPOSURE_MAX.

3. NoNewPrivileges must be in effect.

4. Under that sandbox, the service must still be able to write its state directory and still do its duty.

There is no PID-1 systemd on this box, so nothing that talks to the service manager works here, including the online form of systemd-analyze security. Write the drop-in with your editor and measure with --offline=true. Grading uses systemd's own analyser on the merged unit (the file plus every drop-in), so any combination of directives that gets under the ceiling counts. It then works out, from the merged configuration, whether the service could still reach the paths it needs.