Running application daemons with elevated permissions exposes the host operating system to privilege escalation attacks. Proper Linux production hardening enforces **Systemd Sandboxing**, restricting Node.js processes from modifying system binaries, accessing raw hardware devices, or executing unprivileged shell escapes.
1. Hardened Systemd Service Directives
| Systemd Directive | Security Value | Protection Mechanism |
|---|---|---|
ProtectSystem=strict | Read-Only OS Filesystem | Mounts `/usr`, `/boot`, and `/etc` as read-only for the process. |
ProtectHome=true | Restricts User Data | Hides `/home` and `/root` directories from the application process. |
NoNewPrivileges=true | Prevents SUID Escalation | Disallows process from gaining new privileges via setuid binaries. |
PrivateTmp=true | Isolated `/tmp` Namespace | Allocates an isolated temporary directory invisible to other processes. |