Disable ProtectKernelTunables again
This option was removed in but reintroduced in
Disable it with commentary in hope to prevent slipping it in again.
@@ -64,7 +64,8 @@ ProtectClock=true
ProtectControlGroups=true
ProtectKernelLogs=true
ProtectKernelModules=true
-ProtectKernelTunables=true
+# This breaks using socket options like 'so-rcvbuf'. Explicitly disable for visibility.
+ProtectKernelTunables=false
ProtectProc=invisible
ProtectSystem=strict
RuntimeDirectory=unbound
