Further to PR#6465 ( #6465 ) and the dropping of PermissionsStartOnly, I have a few extra suggestions to the unit file. The ReadWritePaths directive can be changed to ConfigurationDirectory=pihole which grants read/write access to /etc/pihole. If you add LogsDirectory=pihole which grants read/writ…

Forgive me if I am misunderstanding you, it has been a long day. Assuming I am interpreting your statement correctly, I respectfully disagree: It is recommended to enable this setting for all long-running services, unless they are involved with system updates or need to modify the operating system …

[image] robgill: There is the possibility of having different prestart/poststop files for different init systems. Nah the whole point of this request/suggestion is to move things to native systemd sandboxing directives instead of running external pre/post scripts as root user. One could argue…

[image] Distort7841: Forgive me if I am misunderstanding you, it has been a long day. Assuming I am interpreting your statement correctly, I respectfully disagree: It is recommended to enable this setting for all long-running services, unless they are involved with system updates or need to mod…

Yes that is where we were missing each other, thanks for tracking that down. My system uses v252 which explains why I do not need to manually set excluded paths other than using those directives. Would further sandboxing directives, e.g.: ProtectKernelModules= ProtectKernelLogss= ProtectKernelTun…

Just as overview for what I started to use where applicable: ProtectHome=1 # no read access to /home and /root PrivateUsers=1 # no access to user list PrivateTmp=1 # own /tmp PrivateDevices=1 # empty /dev aside of /dev/null /dev/zero /dev/random etc ProtectKernelTunables=1 # most things in /proc R/…

[image] MichaIng: ProtectHome=1 # no read access to /home and /root I think below user doesnt like that change :wink: [image] Dhcp-script for Pi-Hole 6 > cat /etc/dnsmasq.d/01-dhcp-script.conf dhcp-script=/home/pi/bin/dhcpupdate.sh

Thanks for the ping. Given the discussion so far, I can understand the reasons and could put my script somewhere else. The question, though, is: where to put auxiliary scripts and under which user should they run? (In my case DHCP updates trigger an MQTT message.)

Good points here. Some comments/questions: ProtectHome=true is something I run as well. No issues observed (although I do not use the DHCP functionality in Pi-hole). PrivateUsers= is something I actually tried earlier today for the first time - I saw warnings in the logs so undid it immediately, b…

[image] asterisk: The question, though, is: where to put auxiliary scripts and under which user should they run? /usr/local/bin $ printenv PATH /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games That folder doesnt get messed with if run OS upgrades etc. The user would be inherited fr…

[image] Distort7841: PrivateDevices=trueis also something I run. No issues observed, but wonder if this would interfere with RTC clock for example if you had one attached to a Pi? Yes, this would definitely cause problems with the RTC related NTP functionality (Which access the RTC via /dev/e…

Suggestions for systemd service file

Feature Requests

deHakkelaar December 10, 2025, 6:33pm 13

I think below user doesnt like that change