Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Hardening › Least Privilege

Least Privilege

Status: Mix of product-enforced unit settings and operator recommendations. Not a certified hardened deployment standard.Audience: deployment engineer

Product-enforced (in shipped units)

Scroll sideways to see the full table. Use the arrow keys when focused.

ProcessUserCapabilitiesNotes
Managerzwall-managernoneProtectSystem=strict, NoNewPrivileges
Hosting Agentzwall-hostingnonenever joins a customer-content group; v2 SupplementaryGroups=adm only
Hosting loaderroot then reducedCAP_CHOWN CAP_SYS_ADMIN CAP_NET_ADMINpass-only object; Agent gets a UNIX socket
Virtualization Agentrootbounded NET/SYS/IPC/DAC setrequired for XDP/TC

Hosting cannot receive rules or restart via API (409). agents.auto_register example false.

Operator recommendation

  • Do not add Hosting to psaserv or site groups "to make nginx work" without an ACL review (v1 unit still lists psaserv; v2 does not).
  • Do not run Manager as root.
  • Do not enable UID/GID filtering as a supported contract.
  • Leave cluster disabled unless you have an internal HA program.

Not-yet-certified

Secret custody is pending final acceptance. Path prefixes are not unified. Edge mode is not a public certified product.