From a9ab05bde31ff44196296aae176c0152e0bf8bc7 Mon Sep 17 00:00:00 2001
From: James Valleroy <jvalleroy@mailbox.org>
Date: Sun, 26 Jan 2020 10:57:04 -0500
Subject: [PATCH] bind: Enable systemd sandbox options for bind9 service

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
---
 .../system/bind9.service.d/freedombox.conf        | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 plinth/modules/bind/data/lib/systemd/system/bind9.service.d/freedombox.conf

diff --git a/plinth/modules/bind/data/lib/systemd/system/bind9.service.d/freedombox.conf b/plinth/modules/bind/data/lib/systemd/system/bind9.service.d/freedombox.conf
new file mode 100644
index 000000000..09e2117cd
--- /dev/null
+++ b/plinth/modules/bind/data/lib/systemd/system/bind9.service.d/freedombox.conf
@@ -0,0 +1,15 @@
+[Service]
+LockPersonality=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateMounts=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectSystem=full
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictRealtime=yes
+SystemCallArchitectures=native