In Ubuntu Server and other modern Linux distributions, systemd-tmpfiles-setup-dev.service is an early-boot systemd component responsible for creating, cleaning, or adjusting permissions for specific device nodes and directories within the highly sensitive /dev/ filesystem hierarchy. It relies on configuration files located in /usr/lib/tmpfiles.d/ and /etc/tmpfiles.d/ to dynamically provision temporary device structures (like pseudo-terminals or specialized char/block devices) during the boot sequence. While essential in generic Linux desktop environments or highly dynamic hypervisor setups, this automated provisioning introduces an unacceptable layer of volatility in strict, immutable infrastructure. In zero-trust or tightly controlled embedded environments where the /dev/ tree must remain absolutely static and cryptographically verified, allowing a systemd service to dynamically alter device node permissions or create new nodes at boot creates a severe operational security (OPSEC) risk and a potential vector for privilege escalation.
This guide explains how to completely disable the systemd-tmpfiles-setup-dev service in Ubuntu Server, ensuring absolute suppression of dynamic device node generation during the boot sequence.
Stop and Mask the systemd-tmpfiles-setup-dev Service
Because this service executes extremely early in the boot process (often before standard daemons are loaded), simply issuing a ‘disable’ command is insufficient. We must explicitly mask the unit file to guarantee the systemd init process is physically prevented from executing it.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Check if the service is currently active or loaded (it usually runs and exits immediately during boot):
sudo systemctl status systemd-tmpfiles-setup-dev.service - Disable the service to remove it from the systemd boot schedule targets:
sudo systemctl disable systemd-tmpfiles-setup-dev.service - For absolute certainty, explicitly mask the service. This symlinks the unit file to
/dev/null, creating a hard cryptographic block against it being invoked by systemd under any circumstances:sudo systemctl mask systemd-tmpfiles-setup-dev.service
Verify the Service Lockdown
By masking systemd-tmpfiles-setup-dev.service, you guarantee that systemd will strictly rely on the static device nodes populated by the kernel or udev, completely ignoring the dynamic provisioning rules defined in the tmpfiles.d directories for the /dev/ tree.
To verify the lockdown is successful, attempt to start the service manually:
sudo systemctl start systemd-tmpfiles-setup-dev.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-tmpfiles-setup-dev.service: Unit systemd-tmpfiles-setup-dev.service is masked). You have successfully neutralized the automated device node provisioner, hardening your server’s early-boot environment and ensuring compliance with strict, immutable infrastructure requirements where the /dev/ filesystem must be heavily restricted.