clunk.service: stop running clunk as root.

A combination of DynamicUser, SupplementaryGroups, an StateDirectory
allows it to have close to the minimum necessary privilege.

diff --git a/clunk.service b/clunk.service
index 510c3fec3ab883467f4efab7a8bccffd72b90afd..398af7a76cd8380e85ca0b1f22d7d53f775605f1 100644 (file)
--- a/clunk.service
+++ b/clunk.service
@@ -1,10 +1,13 @@
-# systemd unit file for clunk(8)
+# Example systemd unit file for clunk(8) on Raspbian
 [Unit]
 Description=pulse clock driver (clunk)
 Documentation=man:clunk(8)
 
 [Service]
-ExecStart=clunk -f /var/lib/clunk.state -C pinctrl-bcm2835 -L 17
+DynamicUser=true
+SupplementaryGroups=gpio
+StateDirectory=clunk
+ExecStart=clunk -f /var/lib/clunk/clunk.state -C pinctrl-bcm2835 -L 17
 
 [Install]
 WantedBy=multi-user.target