cjdns service: allow daemon to drop privileges

The service can run certain components with reduced privileges, but for
that it needs the setuid capability.
This commit is contained in:
Joachim Fasting 2017-02-05 04:46:58 +01:00
parent a0338afe5f
commit 2628597e76
No known key found for this signature in database
GPG key ID: 7544761007FE4E08

View file

@ -258,8 +258,7 @@ in
Restart = "always";
StartLimitInterval = 0;
RestartSec = 1;
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID";
ProtectSystem = true;
MemoryDenyWriteExecute = true;
ProtectHome = true;