diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in index e3361db59..ec6b3ba28 100644 --- a/contrib/unbound.service.in +++ b/contrib/unbound.service.in @@ -54,7 +54,7 @@ ExecReload=+/bin/kill -HUP $MAINPID ExecStart=@UNBOUND_SBIN_DIR@/unbound -d NotifyAccess=main Type=notify -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW CAP_CHOWN +CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW CAP_CHOWN MemoryDenyWriteExecute=true NoNewPrivileges=true PrivateDevices=true diff --git a/contrib/unbound_portable.service.in b/contrib/unbound_portable.service.in index 9e830cd21..a77df49fa 100644 --- a/contrib/unbound_portable.service.in +++ b/contrib/unbound_portable.service.in @@ -28,7 +28,7 @@ ExecReload=+/bin/kill -HUP $MAINPID ExecStart=@UNBOUND_SBIN_DIR@/unbound -d NotifyAccess=main Type=notify -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW CAP_CHOWN +CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW CAP_CHOWN MemoryDenyWriteExecute=true NoNewPrivileges=true PrivateDevices=true