GitLab

In systemd 231, the MemoryDenyWriteExecute option was added:

      A new service setting MemoryDenyWriteExecute= has been added, taking
      a boolean value. If turned on, a service may no longer create memory
      mappings that are writable and executable at the same time. This
      enhances security for services where this is enabled as it becomes
      harder to dynamically write and then execute memory in exploited
      service processes. This option has been enabled for all of systemd's
      own long-running services.

https://lists.freedesktop.org/archives/systemd-devel/2016-July/037220.html

Can you please add:

MemoryDenyWriteExecute=true

to https://gitweb.torproject.org/tor.git/tree/contrib/dist/tor.service.in in the [Service] section?

Note that systemd < 231 will simply ignore this unknown option so there is no backwards compatibility concern.

Trac:
Username: candrews