In systemd 231, the MemoryDenyWriteExecute option was added: A new service setting MemoryDenyWriteExecute= has been added, taking a boolean value. If turned on, a service may no longer create memory mappings that are writable and executable at the same time. This enhances security for services where this is enabled as it becomes harder to dynamically write and then execute memory in exploited service processes. This option has been enabled for all of systemd's own long-running services. https://lists.freedesktop.org/archives/systemd-devel/2016-July/037220.html Can you please add: ``` MemoryDenyWriteExecute=true ``` to https://gitweb.torproject.org/tor.git/tree/contrib/dist/tor.service.in in the [Service] section? Note that systemd < 231 will simply ignore this unknown option so there is no backwards compatibility concern. **Trac**: **Username**: candrews