feat(systemd): Enhance security with sandboxing/capability restrictions

Added sandboxing options, restricted file system access, and granted
capabilities for real-time scheduling and privileged ports. Improves
security and tightens service isolation.

Signed-off-by: Sven Sager <s.sager@kunbus.com>

Author: naruxde

systemd/pimodbus-master.service

@@ -16,5 +16,18 @@ User=revpi-modbus
 Group=revpi-modbus
 SupplementaryGroups=dialout picontrol
 
+# Sandboxing options
+ProtectSystem=strict
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+
+# Restrict file system access to the following directories
+InaccessiblePaths=/boot /home /root
+
+# Allow realtime scheduling
+LimitRTPRIO=99
+LimitRTTIME=infinity
+
 [Install]
 WantedBy=multi-user.target

systemd/pimodbus-slave.service

@@ -16,5 +16,22 @@ User=revpi-modbus
 Group=revpi-modbus
 SupplementaryGroups=dialout picontrol
 
+# Sandboxing options
+ProtectSystem=strict
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+
+# Restrict file system access to the following directories
+InaccessiblePaths=/boot /home /root
+
+# Allow realtime scheduling
+LimitRTPRIO=99
+LimitRTTIME=infinity
+
+# Allow bind to ports < 1024
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
 [Install]
 WantedBy=multi-user.target