Add CapabilityBoundingSet to systemd unit file

[bukka]

Re-introduced CapabilityBoundingSet that got removed in 7.4: 67cd427 as it was breaking apps. It looks that chroot has been also omitted and it needs to be verified again what is actually needed by FPM. As such this targets master only.

Any feedback for additional capabilities is welcome.

[SjonHortensius]

This looks fine and I wouldn't hesitate too long before putting it in 7.4(.1) again like this

[nikic]

Suggested change

	# Required for dropping privileges for running as a different user and changin owner and root.
	# Required for dropping privileges for running as a different user and changing owner and root.

[SjonHortensius]

Actually - CAP_KILL is also required for workers that run under a different user for fpm to reload properly. As this is hard to debug it might be useful to add that by default

[nikic]

I think at this point it's better to just not add this.

[SjonHortensius]

@nikic I disagree, are you afraid there will be many more bug-reports caused by this more secure-by-default setup? Maybe documenting this in the Migrating-to-7.4 docs with possibly a link to How to find out what linux capabilities a process requires to work? is a better method of preventing that?

[bukka]

This won't go to 7.4. It's just for master.

[iluuu1994]

@bukka What's the state here?

[bukka]

I have got this on my list and will eventually pick it up.