[SakuraIsayeki]

Summary

Install a shared vendor systemd drop-in for both backup and health service templates. The existing service identities and configured backup, staging, and exporter paths remain unchanged.

• CapabilityBoundingSet= removes Linux capabilities; LockPersonality=yes locks the execution domain.
• ProtectKernelTunables=yes, ProtectKernelModules=yes, and ProtectControlGroups=yes restrict changes to host kernel and cgroup settings.
• RestrictRealtime=yes blocks realtime scheduling and RestrictSUIDSGID=yes blocks setting set-ID file bits. The backup unit already had the latter; the shared drop-in also covers health checks.
• Preserve process creation and network access for drivers, PostgreSQL clients, Consul, and exporters. Document the inherited path restrictions, custom-component exceptions, rollout, and rollback.

The sandbox applies to the services and their children, not manual CLI calls or PostgreSQL archive/restore commands running under the database service. It does not isolate data or other processes belonging to the same service account.

Validation

• All existing shell test suites passed, including package build and checks that both installed drop-ins match the source.
• Bash syntax checks and git diff --check passed.
• systemd-analyze verify on systemd 257 loaded both template drop-ins with test copies using /bin/true in place of the unavailable installed executable.
• ShellCheck was unavailable locally. This environment does not run systemd as PID 1, so no real sandboxed backup, health check, remote publication, or restore was run. Before relying on the upgrade, test the actual configured drivers/exporters and an isolated restore on a representative host.