do not firejail unbound

Arch now uses Unbound's default systemd service file, which includes
hardening that conflicts with Firejail. But theoretically this should
all be good enough so we can just drop Firejail from this role?

Existing users should delete the override.

    # rm -r /etc/systemd/system/unbound.service.d

https://bugs.archlinux.org/task/61163
This commit is contained in:
Pig Monkey 2019-09-18 12:59:04 -07:00
parent f8893fe292
commit 41cbcb6f1c
2 changed files with 0 additions and 24 deletions

View file

@ -1,4 +1,3 @@
---
dependencies:
- { role: firejail }
- { role: systemd }

View file

@ -10,29 +10,6 @@
notify:
- restart unbound
- name: Create Unbound systemd unit file directory
file: path=/etc/systemd/system/unbound.service.d state=directory
tags:
- firejail
- name: Push Unbound socket unit file
copy: src=unbound-service-override.conf dest=/etc/systemd/system/unbound.service.d/override.conf
notify:
- reload systemd config
- restart unbound
tags:
- firejail
- name: Remove Unbound systemd unit PID file line
lineinfile: dest=/usr/lib/systemd/system/unbound.service
state=absent
line="PIDFile=/run/unbound.pid"
notify:
- reload systemd config
- restart unbound
tags:
- firejail
- name: Enable and start Unbound
service: name=unbound.service enabled=yes state=started