Analyze a systemd unit.
Most .service files run as root with no sandbox and no restart policy — fine until they aren’t. Paste your unit and get a hardening review: root user, missing sandboxing, no auto-restart, each with the exact directive to add.
root, unsandboxed, and unwatched
A service started by a quick ExecStart with nothing else does three risky things at once: it runs as root, it has the run of the filesystem, and it stays dead if it crashes. systemd can fix all three with a handful of directives that cost nothing — a dedicated user, a few sandbox lines, and a restart policy — but they only help if they’re there. This reads your unit and tells you which are missing.
Hardening one unit is a quick edit. Monitoring relevant managed services for drift is an ongoing task, and control-plane evidence does not establish that every service or host remains hardened.
Harden it, and keep it hardened.
For configured managed services, Infraveil can report process and configured health evidence and apply bounded restart policy. The current elevated Linux/systemd install defaults the launcher service to root; least privilege, recovery success, and continued unit hardening are not guaranteed.
See how it works