From ae2d5276d27f16044382ce49eb2e2459e073e619 Mon Sep 17 00:00:00 2001 From: Pascal Ernster Date: Fri, 20 Sep 2019 04:47:56 +0000 Subject: [PATCH] Downgrade CAP_NET_ADMIN to CAP_NET_RAW in unbound.service Since kernel 3.2, CAP_NET_RAW instead of CAP_NET_ADMIN is sufficient to allow for the usage of the IP_TRANSPARENT socket option. CAP_NET_ADMIN allows far more mayhem then CAP_NET_RAW, so prefer the safer, more restrictive solution. --- contrib/unbound.service.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in index 5c512f1dc..c5f95c76c 100644 --- a/contrib/unbound.service.in +++ b/contrib/unbound.service.in @@ -13,7 +13,7 @@ ExecReload=/bin/kill -HUP $MAINPID ExecStart=@UNBOUND_SBIN_DIR@/unbound NotifyAccess=main Type=notify -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW MemoryDenyWriteExecute=true NoNewPrivileges=true PrivateDevices=true -- 2.47.2