← The export daemon runs as root with no guardrails

Solve in your browser

Edit the files below. The Objectives tick green live as you work. Hit Check when they all pass and your verified proof page is issued automatically.

Objectives

  • Not met: The service runs as a dedicated non-root user
  • Not met: Restart= is set so a crash restarts the daemon
  • Not met: NoNewPrivileges prevents privilege escalation after start
  • Not met: ProtectSystem makes the OS read-only to the service
  • Not met: PrivateTmp isolates the service's temp files
  • Met: ExecStart and the install target are intact

1 of 6 objectives met.

Objectives update live as you edit. Hitting Check commits your proof.

No account needed to explore. When you're ready, browse the rest of the challenges or sign in to save a solve as a verified proof.