Enhance systemd security

[hykilpikonna]

It's a very bad practice to run an exposed networking service as root, and rathole shouldn't recommend doing that. Here are some changes to enhance security:

• DynamicUser=yes – Run the binary in its own minimal-privilege user.
• NoNewPrivileges=yes – Prevents privilege escalation.
• PrivateTmp=yes – Isolates /tmp and /var/tmp to prevent interference.
• PrivateDevices=yes and DevicePolicy=closed – Restricts access to device files.
• ProtectSystem=strict – Makes the filesystem read-only except for essential directories.
• ProtectHome=read-only – Prevents modification of user home directories.
• ProtectControlGroups=yes, ProtectKernelModules=yes, ProtectKernelTunables=yes – Restricts access to kernel-related settings.
• RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK – Limits allowed network families.
• RestrictNamespaces=yes – Disables namespace usage to prevent container escape vulnerabilities.
• RestrictRealtime=yes and RestrictSUIDSGID=yes – Prevents real-time scheduling abuse and SUID/SGID privilege escalation.
• LockPersonality=yes – Prevents personality changes to avoid exploits.
• AmbientCapabilities=CAP_NET_BIND_SERVICE – Allow binding to lower port numbers (e.g. 80)

[Roman2K]

Using this config for both ratholes and ratholec, works very well 👍 Thank you.

For ratholec, it works even without CAP_NET_BIND_SERVICE.