Introduction to systemd on Android and Sandboxing

While stock Android relies on its own init process and servicemanager for system initialization and service management, custom Android builds, embedded systems, or specialized virtualized environments often integrate systemd. This powerful init system brings robust service control, dependency management, and crucially, extensive sandboxing capabilities. Sandboxing in systemd is a critical security feature, isolating services to prevent them from accessing unauthorized resources or performing malicious actions. However, these very protections can lead to frustrating failures when a unit is misconfigured, especially in the tightly controlled Android environment.

This guide delves into the common causes of systemd unit sandbox failures on Android-based systems and provides a systematic, expert-level approach to diagnose and resolve them, ensuring your services run securely and reliably.

Understanding systemd Sandbox Directives

systemd provides a rich set of directives within the [Service] section of a unit file to control its execution environment and resource access. Understanding these is key to debugging:

• PrivateTmp=: Creates a private /tmp and /var/tmp directory for the service, isolating it from other processes. Set to yes by default for many service types.

• ProtectSystem=: Mounts the system directories (e.g., /usr, /boot) as read-only. Can be full (all of /usr, /etc, /boot) or strict (/usr, /etc, /boot, /proc/sys, /sys). Set to full by default for many units.

• ProtectHome=: Mounts /home, /root, and similar user directories as empty or read-only. Essential for multi-user systems.

• NoNewPrivileges=: Prevents the service from gaining new privileges (e.g., via setuid/setgid binaries or capabilities). Highly recommended for security.

• CapabilityBoundingSet=: Drops unnecessary Linux capabilities from the service process. A robust security measure.

• SystemCallFilter=: Filters and restricts the system calls a service can make. Extremely powerful for fine-grained security but prone to breakage if not carefully crafted.

• ReadWritePaths= / ReadOnlyPaths=: Allows specifying exceptions to ProtectSystem= or other protection directives, granting explicit read/write or read-only access to specific paths.

• RestrictNamespaces=: Prevents the service from creating or entering certain kernel namespaces (e.g., cgroup, ipc, mnt, net, pid, user, uts).

Common Symptoms of Sandbox Failures

When a systemd unit fails due to sandboxing, the symptoms often include:

• The unit fails to start, showing an exited or failed status.
• Android Mobile Specs & Compare Directory

  Are you researching mobile hardware properties, processor SoCs, GPU chipsets, or RAM configurations? Access our complete specs catalog to compare up to 5 devices side-by-side!

  Compare Devices Specs →