Stephen Chin e0aaacdb96 fix(hermes-agent): restrict /proc access in systemd services ...

Hermes strips sensitive env vars from tool subprocesses, but child
processes can recover them by reading /proc/<parent_pid>/environ. Add
ProtectProc=invisible and ProcSubset=pid to both systemd services to
hide other processes' /proc entries and limit /proc to the service's
own PID namespace.

Ref: https://github.com/NousResearch/hermes-agent/issues/4427

2026-05-02 08:09:00 -07:00

3.4 KiB

Raw Blame History

View Raw