https://bugzilla.suse.com/show_bug.cgi?id=1193172 https://bugzilla.suse.com/show_bug.cgi?id=1193172#c16 --- Comment #16 from Johannes Segitz <jsegitz@suse.com> --- I tested this with lirc and also had a quick look at the systemd sources. I don't think that custom home directories are considered there. To make sure I created a service with the hardening options to give me a reverse shell into the service. I'm able to execute all the commands in there without issues. For the reporters you can do this with zypper in gnu-netcat cat << EOF > /etc/systemd/system/test.service [Unit] Description=Test service Requires=local-fs.target After=local-fs.target [Service] ProtectSystem=full ProtectHome=true ProtectHostname=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true RestrictRealtime=true Type=oneshot RemainAfterExit=yes ExecStart= /usr/bin/nc 127.0.0.1 3000 -e /bin/bash [Install] WantedBy=basic.target Alias=bootmsg.service EOF in one shell start the listener: nc -nlp 3000 then start the service: systemctl daemon-reload systemctl start test you now should have a shell where you can go through the commands. For me they all work (but for me the service also starts ;)) -- You are receiving this mail because: You are on the CC list for the bug.