From 0c344784e933938dc79d61ea2efe65c3c8211b21 Mon Sep 17 00:00:00 2001
From: Dimitris <dimitris.koukoulakis@gmail.com>
Date: Wed, 27 Dec 2023 18:30:02 +0200
Subject: [PATCH] Update systemd.service

some restrictions need to be removed for cjdns to be able to create the tun0 device
---
 conf/systemd.service | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/conf/systemd.service b/conf/systemd.service
index 7915a85..c4357c4 100644
--- a/conf/systemd.service
+++ b/conf/systemd.service
@@ -3,8 +3,8 @@ Description=Cjdns: Encrypted IPv6 network
 After=network.target cjdns.service
 
 [Service]
-User=__APP__
-Group=__APP__
+User=root
+Group=root
 WorkingDirectory=__INSTALL_DIR__/
 ExecStart=/bin/bash -c '__INSTALL_DIR__/cjdroute < __INSTALL_DIR__/cjdroute.conf'
 KillMode=process
@@ -16,12 +16,9 @@ Restart=no
 # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
 NoNewPrivileges=yes
 PrivateTmp=yes
-PrivateDevices=yes
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 RestrictNamespaces=yes
 RestrictRealtime=yes
-DevicePolicy=closed
-ProtectClock=yes
 ProtectHostname=yes
 ProtectProc=invisible
 ProtectSystem=full
@@ -30,7 +27,6 @@ ProtectKernelModules=yes
 ProtectKernelTunables=yes
 LockPersonality=yes
 SystemCallArchitectures=native
-SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
 
 # Denying access to capabilities that should not be relevant for webapps
 # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
@@ -41,7 +37,7 @@ CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
 CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
 CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
 CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
-CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_NET_RAW
 CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
 
 [Install]