From 41cbcb6f1c7dfed4062945179ba4ef4e3373387a Mon Sep 17 00:00:00 2001
From: Pig Monkey <pm@pig-monkey.com>
Date: Wed, 18 Sep 2019 12:59:04 -0700
Subject: [PATCH] do not firejail unbound

Arch now uses Unbound's default systemd service file, which includes
hardening that conflicts with Firejail. But theoretically this should
all be good enough so we can just drop Firejail from this role?

Existing users should delete the override.

    # rm -r /etc/systemd/system/unbound.service.d

https://bugs.archlinux.org/task/61163
---
 roles/unbound/meta/main.yml  |  1 -
 roles/unbound/tasks/main.yml | 23 -----------------------
 2 files changed, 24 deletions(-)

diff --git a/roles/unbound/meta/main.yml b/roles/unbound/meta/main.yml
index ee895d1..a0729fb 100644
--- a/roles/unbound/meta/main.yml
+++ b/roles/unbound/meta/main.yml
@@ -1,4 +1,3 @@
 ---
 dependencies:
-  - { role: firejail }
   - { role: systemd }
diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml
index 0563766..57c4ae9 100644
--- a/roles/unbound/tasks/main.yml
+++ b/roles/unbound/tasks/main.yml
@@ -10,29 +10,6 @@
   notify:
     - restart unbound
 
-- name: Create Unbound systemd unit file directory
-  file: path=/etc/systemd/system/unbound.service.d state=directory
-  tags:
-    - firejail
-
-- name: Push Unbound socket unit file
-  copy: src=unbound-service-override.conf dest=/etc/systemd/system/unbound.service.d/override.conf
-  notify:
-    - reload systemd config
-    - restart unbound
-  tags:
-    - firejail
-
-- name: Remove Unbound systemd unit PID file line
-  lineinfile: dest=/usr/lib/systemd/system/unbound.service
-              state=absent
-              line="PIDFile=/run/unbound.pid"
-  notify:
-    - reload systemd config
-    - restart unbound
-  tags:
-    - firejail
-
 - name: Enable and start Unbound
   service: name=unbound.service enabled=yes state=started