systemd version the issue has been seen with
247.3-1

Used distribution
Debian Unstable

Linux kernel version used (uname -a)
5.10.0-4-amd64 #1 SMP Debian 5.10.19-1 (2021-03-02) x86_64 GNU/Linux

Expected behaviour you didn't see

When using the following configuration:

ProtectSystem=strict
TemporaryFileSystem=/

I would have expected / to be an empty tmpfs, which is more secure than even ProtectSystem=strict (which only makes the host / read-only).

Unexpected behaviour you saw

TemporaryFileSystem=/ is ignored and the host / is accessible read-only from within the unit. This weakens security.

Steps to reproduce the problem

The following service:

[Service]
ExecStart=/bin/cat /proc/mounts

ProtectSystem=strict
TemporaryFileSystem=/
BindReadOnlyPaths=/bin /lib /lib64 /proc

Outputs mount information that shows the host / is accessible read-only. If the ProtectSystem=strict line is commented out, only the paths specified in BindPaths= are accessible.

Alternatively, one would way to improve on this situation could be to add another option to ProtectSystem=, which could be named e.g. inaccessible and would prevent all access (even read only) to paths that are not strictly required for typical programs to run.

The use case is as follows: I want to prevent services from reading top-level / directories that they have no business reading. For example stuff like /srv, /mnt, /boot, /media, /opt, etc. I want to use an allowlist to make sure that any new files/directories that may be created in the future under / will be inaccessible by default.