unbound.service.in: don't write pidfile at start

Pidfiles aren't needed while running unbound through systemd.
The PID of the unbound daemon can still be obtained with:
'systemctl show --property MainPID --value unbound'.

While disabling pidfiles we can also drop CAP_CHOWN and writable
/run directory.

diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
index ec6b3ba28020fcc529e9c748b0fcb3e539d05e8a..8c51bcbbef786e936f13adb07e7e42c0a482fa86 100644 (file)
--- a/contrib/unbound.service.in
+++ b/contrib/unbound.service.in
@@ -51,10 +51,10 @@ WantedBy=multi-user.target
 
 [Service]
 ExecReload=+/bin/kill -HUP $MAINPID
-ExecStart=@UNBOUND_SBIN_DIR@/unbound -d
+ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW CAP_CHOWN
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -75,11 +75,6 @@ LockPersonality=yes
 RestrictSUIDSGID=yes
 ReadWritePaths=@UNBOUND_RUN_DIR@ @UNBOUND_CHROOT_DIR@
 
-# Below is needed when pidfile is stored directly under /run like /run/unbound.pid.
-# If pidfile is stored under subdirectory like /run/unbound/unbound.pid instead
-# then it may be safely removed.
-ReadWritePaths=/run
-
 # Below rules are needed when chroot is enabled (usually it's enabled by default).
 # If chroot is disabled like chrooot: "" then they may be safely removed.
 TemporaryFileSystem=@UNBOUND_CHROOT_DIR@/dev:ro

diff --git a/contrib/unbound_portable.service.in b/contrib/unbound_portable.service.in
index a77df49fab29559b57d5c799d985d859bb89d772..998b66dec999f93284e09f07b9ea6ef605d31baa 100644 (file)
--- a/contrib/unbound_portable.service.in
+++ b/contrib/unbound_portable.service.in
@@ -4,13 +4,11 @@
 ; To use this unit file, please make sure you either compile unbound with the
 ; following options:
 ;
-;  - --with-pidfile=/run/unbound/unbound.pid
 ;  - --with-chroot-dir=""
 ;
 ; Or put the following options in your unbound configuration file:
 ;
 ;  - chroot: ""
-;  - pidfile: /run/unbound/unbound.pid
 ;
 ;
 [Unit]
@@ -25,10 +23,10 @@ WantedBy=multi-user.target
 
 [Service]
 ExecReload=+/bin/kill -HUP $MAINPID
-ExecStart=@UNBOUND_SBIN_DIR@/unbound -d
+ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW CAP_CHOWN
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true