[Unit]
Description=opendkim Milter
Documentation=man:opendkim(8) man:opendkim.conf(5) man:opendkim-lua(3) man:opendkim-genkey(8) man:opendkim-genzone(8) man:opendkim-testkey(8) man:opendkim-testmsg(8)
After=network-online.target nss-lookup.target
Wants=network-online.target

# Best-effort ordering so opendkim is ready before a local MTA starts
# accepting mail.  The authoritative way to guarantee ordering is on the
# consumer side, e.g. "After=opendkim.service" (and "Wants=opendkim.service")
# in the MTA unit.
Before=postfix.service sendmail.service exim.service exim4.service opensmtpd.service

[Service]
Type=notify
RuntimeDirectory=opendkim
RuntimeDirectoryMode=0750
ExecStart=/usr/sbin/opendkim -f -x /etc/opendkim.conf
ExecReload=/bin/kill -USR1 $MAINPID
Restart=on-failure

# opendkim feeds this watchdog from a dedicated thread at half the interval
# below (i.e. every 15s).  systemd restarts the service if no keep-alive
# arrives within WatchdogSec, catching a wholly hung process.
WatchdogSec=30
User=opendkim
Group=opendkim

# As the file system is mounted read-only with ProtectSystem=strict, adding
# /var/spool/postfix/opendkim by default makes it possible to use opendkim
# with postfix without further configuration.
ReadWritePaths=-/var/spool/postfix/opendkim
RuntimeDirectory=opendkim

# Hardening - see systemd.exec(5)
CapabilityBoundingSet=
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateMounts=true
PrivateTmp=true
PrivateUsers=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~ @privileged @resources

# These lines prevent opendkim from executing any binary other than itself,
# which is a strong mitigation against an attacker spawning a shell.
# IMPORTANT: if you use ReportAddress or ReportCommand in opendkim.conf,
# opendkim will popen() a mail submission binary (sendmail by default).
# In that case you must add the binary's path, e.g.:
#   ExecPaths=@sbindir@/opendkim /usr/lib /usr/sbin/sendmail
# or override via: systemctl edit opendkim.service
NoExecPaths=/
ExecPaths=@sbindir@/opendkim /usr/lib

[Install]
WantedBy=multi-user.target
