FYI: System hardening on Debian and Ubuntu and Monit

[Jan-Henrik Haukeland]

FYI: The Debian maintainer has set up system hardening for Monit [1] which I 
believe is also carried over to Ubuntu 24. It is worth considering that system 
hardening could potentially influence the execution of the monit binary. System 
hardening measures include settings that restrict the execution environment of 
binaries, such as:

   • Restricting Execution Permissions: Ensuring that only certain binaries or 
scripts can be executed.
   • Changing Execution Contexts: Applying sandboxing techniques or limiting 
the capabilities of the binary.

To determine if system hardening is affecting the monit binary, you can check 
the Monit service file at /lib/systemd/system/monit.service for any hardening 
options enabled. These might include directives like NoNewPrivileges, 
ProtectSystem, ProtectHome, CapabilityBoundingSet, etc.

See also https://mmonit.com/wiki/Monit/FAQ#hardening