unbound.service.in: allow CAP_CHOWN

CAP_CHOWN is needed for changing onwership of pidfile before
dropping privileges and truncate pidfile on exit.

diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
index b1211a4be291bb7ddca0bcb01a1015a2c5c328d9..e3361db59f76b24b50f661ee5e2291ef1297dd9f 100644 (file)
--- a/contrib/unbound.service.in
+++ b/contrib/unbound.service.in
@@ -54,7 +54,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW CAP_CHOWN
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true

diff --git a/contrib/unbound_portable.service.in b/contrib/unbound_portable.service.in
index cbfc58f9907db0e05a1855dbfcf42eefc5fdcf8c..9e830cd21443b4d9d6ae572919fe9bd330ad816f 100644 (file)
--- a/contrib/unbound_portable.service.in
+++ b/contrib/unbound_portable.service.in
@@ -28,7 +28,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW CAP_CHOWN
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true