4️⃣ Here's the 4th installment of my series of posts highlighting key new features of the upcoming v256 release of systemd.
You might be aware of systemd's per-service setting "ProtectSystem=". When used it ensures the service lives in its own mount namespace, detached from the host's and various key directories become read-only to the service, in particular /usr/. This reflects the fact there's very little code that should ever be able to to write to /usr/.
