[Unit]
After=local-fs.target network.target
Description=Clam AntiVirus userspace daemon in chroot
Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/
#Requires=clamav-daemon-chroot.socket
# Check for database existence
ConditionPathExistsGlob=/chroot/maild/var/lib/clamav/main.{c[vl]d,inc}
ConditionPathExistsGlob=/chroot/maild/var/lib/clamav/daily.{c[vl]d,inc}
PartOf=chr-maild.target

[Service]

RootDirectory=/chroot/maild
RootDirectoryStartOnly=no

User=clamav
Group=clamav

#ExecStartPre=/sbin/paxctl -cm /chroot/maild/usr/sbin/clamd
ExecStart=/usr/sbin/clamd --foreground=true -c /etc/clamav/clamd.conf
# Reload the database
ExecReload=/bin/kill -USR2 $MAINPID
StandardOutput=journal

PrivateTmp=true
MountAPIVFS=true
NoNewPrivileges=true
PrivateDevices=true
DevicePolicy=closed
ProtectSystem=full
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectProc=invisible
ProcSubset=pid
ProtectControlGroups=true
ProtectClock=true
ProtectHome=true
#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
#CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH
#RestrictNamespaces=uts ipc pid user cgroup
#RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
#MemoryDenyWriteExecute=yes # (clamav needs this)
#LockPersonality=yes
ReadOnlyPaths=/bin /sbin /lib /lib64 /usr /boot /etc
ReadOnlyPaths=/chroot/maild
ReadWritePaths=/chroot/maild/run
ReadWritePaths=/chroot/maild/var/lib/clamav /chroot/maild/var/log/clamav /chroot/maild/var/lib/amavis
InaccessiblePaths=/chroot/maild/boot /chroot/maild/sys /chroot/maild/proc

# run
BindPaths=/chroot/maild/run:/run:norbind
# log, systemd notify
BindPaths=/run/systemd/notify:/run/systemd/notify:norbind /run/systemd/journal/dev-log:/run/systemd/journal/dev-log:norbind


[Install]
#WantedBy=multi-user.target
WantedBy=chr-maild.target
#Also=clamav-daemon-chroot.socket