Practical guide on out of tree mitigations on Linux
A hands-on guide walks through hardening existing Linux services without modifying their source: hardened allocators, systemd syscall filtering, filesystem restrictions and other isolation controls.
The examples are starting points, not a universal security profile. Restrictions need testing against the service’s actual behavior, and blocking shell execution alone does not prevent an attacker from using the permissions and files the process retains.