Add AF_NETLINK to set of allowed socket address families

contrib/unbound{,_portable}.service.in: With the changes introduced in f6a527c it is now necessary to also allow access to the AF_NETLINK socket address family to be able to get information from interfaces. Without the AF_NETLINK address family the systemd service errors with: ``` error: failed to list interfaces: getifaddrs: Address family not supported by protocol ``` Fixes NLnetLabs#350
dvzrv · Nov 21, 2020 · c48f014 · c48f014
1 parent b891fe1
commit c48f014
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
@@ -66,7 +66,7 @@ ProtectSystem=strict
 RuntimeDirectory=unbound
 ConfigurationDirectory=unbound
 StateDirectory=unbound
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
 RestrictRealtime=true
 SystemCallArchitectures=native
 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources

diff --git a/contrib/unbound_portable.service.in b/contrib/unbound_portable.service.in
@@ -38,7 +38,7 @@ ProtectSystem=strict
 RuntimeDirectory=unbound
 ConfigurationDirectory=unbound
 StateDirectory=unbound
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
 RestrictRealtime=true
 SystemCallArchitectures=native
 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources