Edit the systemd service file of net-vpn/cloudflared to harden the sy…

…stem

net-vpn/cloudflared/files/cloudflared.service

@@ -6,14 +6,14 @@ Wants=network.target
 [Service]
 Type=notify
 ExecStart=/usr/bin/cloudflared --config /etc/cloudflared/config.yml --no-autoupdate
-User=cloudflared
-Group=cloudflared
+DynamicUser=true
+PrivateUsers=true
 Restart=on-failure
 RestartSec=5s
 TimeoutStartSec=0
 
-# Allow cloudflared access to logfile
-ReadWritePaths=/var/log/cloudflared.log
+LogsDirectory=cloudflared
+ConfigurationDirectory=cloudflared
 
 # Allow cloudflared to bind ports in the range of 0-1024 and restrict it to
 # that capability
@@ -24,7 +24,6 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE
 # drop-in file
 #CapabilityBoundingSet=
 #AmbientCapabilities=
-#PrivateUsers=yes
 
 NoNewPrivileges=true
 LimitNOFILE=1048576
@@ -33,6 +32,7 @@ UMask=0077
 ProtectSystem=strict
 ProtectHome=true
 PrivateTmp=true
+PrivateMounts=true
 PrivateDevices=true
 ProtectHostname=true
 ProtectClock=true
@@ -52,5 +52,8 @@ SystemCallFilter=@system-service
 SystemCallFilter=~@privileged @resources
 SystemCallArchitectures=native
 
+NoExecPaths=/
+ExecPaths=/usr/bin/cloudflared /usr/lib64 /usr/lib
+
 [Install]
 WantedBy=multi-user.target