cjdns service: allow daemon to drop privileges

The service can run certain components with reduced privileges, but for
that it needs the setuid capability.

Changed files
+1 -2
nixos
modules
services
networking
+1 -2
nixos/modules/services/networking/cjdns.nix
···
Restart = "always";
StartLimitInterval = 0;
RestartSec = 1;
-
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
-
AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
ProtectSystem = true;
MemoryDenyWriteExecute = true;
ProtectHome = true;
···
Restart = "always";
StartLimitInterval = 0;
RestartSec = 1;
+
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID";
ProtectSystem = true;
MemoryDenyWriteExecute = true;
ProtectHome = true;