- Fix #4142: unbound.service.in: improvements and fixes.

  Add unit dependency ordering (based on systemd-resolved).
  Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings
  about missing privileges during startup). Add 'AF_INET6' to
  'RestrictAddressFamilies' (without it IPV6 can't work). From
  Guido Shanahan.

git-svn-id: file:///svn/unbound/trunk@4834 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
index b3856690a4ca42e6c7323c075c2252edf6bcfb1c..95976dd9425a536c4d8032cf12e1a36ca9704d77 100644 (file)
--- a/contrib/unbound.service.in
+++ b/contrib/unbound.service.in
@@ -1,6 +1,9 @@
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
+After=network.target
+Before=network-online.target nss-lookup.target
+Wants=nss-lookup.target
 
 [Install]
 WantedBy=multi-user.target
@@ -10,7 +13,7 @@ ExecReload=/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT
+CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -21,7 +24,7 @@ ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectSystem=strict
 ReadWritePaths=@UNBOUND_SYSCONF_DIR@ @UNBOUND_LOCALSTATE_DIR@ /run @UNBOUND_RUN_DIR@
-RestrictAddressFamilies=AF_INET AF_UNIX
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
 RestrictRealtime=true
 SystemCallArchitectures=native
 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources

diff --git a/doc/Changelog b/doc/Changelog
index b9cb9cd58649c01b312719b78382f54d52824e4c..adb245f5b13e609acaab7b752da597a5d2773869 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,11 @@
+7 August 2018: Wouter
+       - Fix #4142: unbound.service.in: improvements and fixes.
+         Add unit dependency ordering (based on systemd-resolved).
+         Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings
+         about missing privileges during startup). Add 'AF_INET6' to
+         'RestrictAddressFamilies' (without it IPV6 can't work). From
+         Guido Shanahan.
+
 6 August 2018: Wouter
        - Fix for #4136: Fix to unconditionally call destroy in daemon.c.