hblock.service

[Unit]
Description=hBlock

[Service]
Type=oneshot
ExecStart=/bin/sh -c 'exec hblock -O "%C/hblock/hosts"'
ExecStartPost=+/bin/sh -c 'exec cat "%C/hblock/hosts" > /etc/hosts'
ExecStartPost=-/bin/sh -c 'exec rm -f "%C/hblock/hosts"'
CacheDirectory=hblock
UMask=0077
DynamicUser=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
PrivateUsers=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=~@clock
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@debug
SystemCallFilter=~@module
SystemCallFilter=~@mount
SystemCallFilter=~@obsolete
SystemCallFilter=~@privileged
SystemCallFilter=~@raw-io
SystemCallFilter=~@reboot
SystemCallFilter=~@resources
SystemCallFilter=~@swap
SystemCallArchitectures=native
CapabilityBoundingSet=
DevicePolicy=closed
ProcSubset=pid
NoNewPrivileges=yes