security: restrict abis in bitcoind.service

[CharlieC3]

As noted here, it's a good idea to pair MemoryDenyWriteExecute=true with SystemCallArchitectures=native because MemoryDenyWriteExecute can be circumvented in some operating systems which support multiple ABIs like x86/x86-64.
This helps restrict the possible application binary interfaces (ABIs) that can be used when running bitcoind through systemd, reducing the attack surface area.

[DrahtBot]

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage

For detailed information about the code coverage, see the test coverage report.

Reviews

See the guideline for information on the review process.

Type	Reviewers
ACK	laanwj, 0xB10C
Concept ACK	Sjors

If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

[Sjors]

Probably Concept ACK, because nix-bitcoin does this too: https://github.com/fort-nix/nix-bitcoin/blob/master/pkgs/lib.nix

Might as well consider all the extra stuff they added there.

[laanwj]

ACK 0244416 . This is a sensible security feature.
It looks like the documentation of systemd.exec even mentions this pairing.

I do agree with @Sjors, however, that when we're adding systemd hardening options, we might as well look further.

[0xB10C]

ACK 0244416