[VarmRay]

My systemd complained about the use of the nobody user. Using DynamicUser=yes instead is recommended in this case.

I furthermore added a few options that I think might be worth adding without too much risk of breaking something. However, I'm not too familiar with the sources and all of V2ray's features and I might be wrong about some of the options. If so, I can remove conflicting options from this PR.

I myself have tested a far more extensive set of sandboxing options, inluding the ones suggested in this PR. See my systemd-drop-in file:

[Unit]
Description=V2Ray Service
Documentation=https://www.v2fly.org/
After=network.target nss-lookup.target

[Service]
# User is set in the main unit file already
User=
DynamicUser=yes
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
LockPersonality=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelLogs=true
PrivateUsers=yes
SystemCallFilter=@system-service
CapabilityBoundingSet=CAP_NET_ADMIN
SystemCallArchitectures=native
ProtectProc=invisible

This has been working for around a year now an a simple client and server setup (both client and server use that drop-in file). I had no issues with it so far.

Please let me know if something is missing or wrong so I am able to fix it. If there is a simple test-setup, I might also be able to run that.