unbound.service.in: upgrade hardening to latest standards

Systemd gradually introduced new protection bits, let’s enable them.

diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
index a4596978dbe2d2f7cfa91fd75a71fafb1a16a429..90ee708ce2c5453b2602c5e81ee803d841d16dac 100644 (file)
--- a/contrib/unbound.service.in
+++ b/contrib/unbound.service.in
@@ -60,8 +60,12 @@ NoNewPrivileges=true
 PrivateDevices=true
 PrivateTmp=true
 ProtectHome=true
+ProtectClock=true
 ProtectControlGroups=true
+ProtectKernelLogs=true
 ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=invisible
 ProtectSystem=strict
 RuntimeDirectory=unbound
 ConfigurationDirectory=unbound