--- dcc-2.3.169.orig/debian/README.Debian
+++ dcc-2.3.169/debian/README.Debian
@@ -0,0 +1,24 @@
+DCC clients use the UDP port 6277 for outgoing connections. For more
+information see "Which ports do I need to open in my firewall?" in FAQ.html.
+
+Enable DCC with:
+
+    systemctl enable --now dccifd.service
+
+If you use rspamd, set DCCM_REJECT_AT=MANY in /etc/dcc/dcc_conf and follow the
+instructions in https://www.rspamd.com/doc/modules/dcc.html.
+
+If you use SpamAssassin, enable the DCC plugin in
+/etc/mail/spamassassin/v310.pre.
+
+If you use Exim, append -SX-Envelope-From to DCCIFD_ARGS in /etc/dcc/dcc_conf
+and use the X-Envelope-From header instead of env_From in /etc/dcc/whiteclnt.
+Example:
+
+    ok substitute X-Envelope-From <someone@example.com>
+
+The programs cdcc, dccproc and dccsight are installed without setuid
+permissions, which are only required if DCC is run by ordinary users. Run
+"dpkg-reconfigure -plow dcc" to set the permissions on Debian-based systems.
+On RPM-based distributions, build your own packages with "rpmbuild --with
+install_setuid dcc.spec".
--- dcc-2.3.169.orig/debian/changelog
+++ dcc-2.3.169/debian/changelog
@@ -0,0 +1,11 @@
+dcc (2.3.169-1+8.91) unstable; urgency=low
+
+  * version number update by debtransform
+
+ -- debtransform <build@opensuse.org>  Mon, 08 Jun 2026 03:50:21 +0000
+
+dcc (2.3.169-1) unstable; urgency=low
+
+  * Package dcc 2.3.169
+
+ -- Andreas Vögele <andreas@andreasvoegele.com>  Sat, 03 Aug 2024 08:28:10 +0200
--- dcc-2.3.169.orig/debian/config
+++ dcc-2.3.169/debian/config
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+. /usr/share/debconf/confmodule
+db_version 2.0
+
+db_input low dcc/install-setuid || true
+db_go
+
+exit 0
--- dcc-2.3.169.orig/debian/control
+++ dcc-2.3.169/debian/control
@@ -0,0 +1,38 @@
+Source: dcc
+Section: non-free/mail
+Priority: optional
+Maintainer: Andreas Vögele <andreas@andreasvoegele.com>
+Build-Depends: debhelper-compat (= 13),
+               libmilter-dev,
+               libtemplate-perl (>= 2),
+               perl,
+               systemd
+Standards-Version: 4.7.0
+Homepage: https://www.dcc-servers.net/dcc/
+Rules-Requires-Root: no
+
+Package: dcc
+Architecture: any
+Depends: ${misc:Depends},
+         ${shlibs:Depends}
+Suggests: rspamd,
+          spamassassin
+Conflicts: dcc-client, dcc-common, dcc-server
+Provides: dcc-client, dcc-common, dcc-server
+Description: Identify bulk email
+ The DCC or Distributed Checksum Clearinghouse is a system of thousands of
+ clients and many servers collecting and counting checksums related to
+ millions of email messages per day.  The counts can be used by SMTP servers,
+ rspamd and SpamAssassin to filter unsolicited bulk email.  DCC is free to
+ organizations that participate in the global DCC network.
+
+Package: dcc-milter
+Architecture: any
+Depends: ${misc:Depends},
+         ${shlibs:Depends},
+         dcc (= ${binary:Version})
+Suggests: sendmail
+Description: Connect sendmail to DCC servers
+ dccm is a daemon built with the sendmail milter interface.  When sendmail is
+ configured to talk to dccm, all email is passed to dccm which reports related
+ checksums to a DCC server and returns the response.
--- dcc-2.3.169.orig/debian/copyright
+++ dcc-2.3.169/debian/copyright
@@ -0,0 +1,122 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Source: https://www.dcc-servers.net/dcc/
+Disclaimer: DCC is free to organizations that participate in the global DCC network.
+
+Files: *
+Copyright: 2019 Rhyolite Software, LLC
+License: LicenseRef-Rhyolite
+
+Files: autoconf/install-sh
+Copyright: 1991 Massachusetts Institute of Technology
+License: MIT
+
+Files: clntlib/getifaddrs.c include/dcc_ifaddrs.h
+Copyright: 2006 WIDE Project
+License: BSD-3-Clause
+
+Files: clntlib/getopt.c include/sendmail-sysexits.h
+Copyright: 1987, 1993, 1994 The Regents of the University of California
+License: BSD-4-Clause-UC
+
+Files: clntlib/inet_pton.c dcclib/inet_ntop.c
+Copyright: 2004 Internet Systems Consortium, Inc.
+ 1996-1999 Internet Software Consortium
+License: ISC
+
+Files: debian/*
+Copyright: 2024 Andreas Vögele
+License: ISC
+
+License: LicenseRef-Rhyolite
+ Permission to use, copy, modify, and distribute this software without
+ changes for any purpose with or without fee is hereby granted, provided
+ that the above copyright notice and this permission notice appear in all
+ copies and any distributed versions or copies are either unchanged
+ or not called anything similar to "DCC" or "Distributed Checksum
+ Clearinghouse".
+ .
+ THE SOFTWARE IS PROVIDED "AS IS" AND RHYOLITE SOFTWARE, LLC DISCLAIMS ALL
+ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL RHYOLITE SOFTWARE, LLC
+ BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES
+ OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+ WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+License: MIT
+ Permission to use, copy, modify, distribute, and sell this software and its
+ documentation for any purpose is hereby granted without fee, provided that
+ the above copyright notice appear in all copies and that both that
+ copyright notice and this permission notice appear in supporting
+ documentation, and that the name of M.I.T. not be used in advertising or
+ publicity pertaining to distribution of the software without specific,
+ written prior permission.  M.I.T. makes no representations about the
+ suitability of this software for any purpose.  It is provided "as is"
+ without express or implied warranty.
+
+License: BSD-3-Clause
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 1. Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+ 3. Neither the name of the copyright holder nor the names of its
+    contributors may be used to endorse or promote products derived from this
+    software without specific prior written permission.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ''AS IS'' AND
+ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ SUCH DAMAGE.
+
+License: BSD-4-Clause-UC
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 1. Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+ 3. All advertising materials mentioning features or use of this software
+    must display the following acknowledgement:
+      This product includes software developed by the University of
+      California, Berkeley and its contributors.
+ 4. Neither the name of the University nor the names of its contributors
+    may be used to endorse or promote products derived from this software
+    without specific prior written permission.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ''AS IS'' AND
+ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ SUCH DAMAGE.
+
+License: ISC
+ Permission to use, copy, modify, and distribute this software for any
+ purpose with or without fee is hereby granted, provided that the above
+ copyright notice and this permission notice appear in all copies.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
--- dcc-2.3.169.orig/debian/dbclean.service.tt
+++ dcc-2.3.169/debian/dbclean.service.tt
@@ -0,0 +1,12 @@
+[%# vim: set ft=tt2: -%]
+[Unit]
+Description=DCC cleanup
+Documentation=man:dbclean(8)
+
+[Service]
+Type=oneshot
+User=dcc
+ExecStart=[% libexecdir %]/cron-dccd
+Nice=5
+IOSchedulingClass=idle
+[% INCLUDE $systemd_security -%]
--- dcc-2.3.169.orig/debian/dbclean.timer.tt
+++ dcc-2.3.169/debian/dbclean.timer.tt
@@ -0,0 +1,12 @@
+[%# vim: set ft=tt2: -%]
+[Unit]
+Description=Daily DCC cleanup
+Documentation=man:dbclean(8)
+
+[Timer]
+OnCalendar=daily
+AccuracySec=12h
+Persistent=true
+
+[Install]
+WantedBy=timers.target
--- dcc-2.3.169.orig/debian/dcc-milter.docs
+++ dcc-2.3.169/debian/dcc-milter.docs
@@ -0,0 +1 @@
+LICENSE
--- dcc-2.3.169.orig/debian/dcc-milter.install
+++ dcc-2.3.169/debian/dcc-milter.install
@@ -0,0 +1,5 @@
+lib/systemd/system/dccm.service
+usr/lib/dcc/dccm
+usr/lib/dcc/start-dccm
+usr/share/dcc/*.m4
+usr/share/man/man8/dccm.8*
--- dcc-2.3.169.orig/debian/dcc.sysusers
+++ dcc-2.3.169/debian/dcc.sysusers
@@ -0,0 +1 @@
+u dcc - "DCC user" /var/lib/dcc
--- dcc-2.3.169.orig/debian/dccifd.service.tt
+++ dcc-2.3.169/debian/dccifd.service.tt
@@ -0,0 +1,19 @@
+[%# vim: set ft=tt2: -%]
+[Unit]
+Description=DCC spam filter interface daemon
+After=network.target
+Before=spamd.service postfix.service
+Wants=dbclean.timer
+Documentation=man:dccifd(8)
+
+[Service]
+Type=forking
+User=dcc
+RuntimeDirectory=dcc
+UMask=0077
+ExecStart=[% libexecdir %]/start-dccifd
+SuccessExitStatus=95
+[% INCLUDE $systemd_security -%]
+
+[Install]
+WantedBy=multi-user.target
--- dcc-2.3.169.orig/debian/dccm.service.tt
+++ dcc-2.3.169/debian/dccm.service.tt
@@ -0,0 +1,19 @@
+[%# vim: set ft=tt2: -%]
+[Unit]
+Description=DCC milter interface daemon
+After=network.target
+Before=sendmail.service
+Wants=dbclean.timer
+Documentation=man:dccm(8)
+
+[Service]
+Type=forking
+User=dcc
+RuntimeDirectory=dcc
+UMask=0077
+ExecStart=[% libexecdir %]/start-dccm
+SuccessExitStatus=95
+[% INCLUDE $systemd_security -%]
+
+[Install]
+WantedBy=multi-user.target
--- dcc-2.3.169.orig/debian/docs
+++ dcc-2.3.169/debian/docs
@@ -0,0 +1,12 @@
+LICENSE
+FAQ.html
+INSTALL.html
+cdcc.html
+dbclean.html
+dblist.html
+dccd.html
+dcc.html
+dccifd.html
+dccm.html
+dccproc.html
+dccsight.html
--- dcc-2.3.169.orig/debian/install
+++ dcc-2.3.169/debian/install
@@ -0,0 +1,56 @@
+lib/systemd/system/dbclean.service
+lib/systemd/system/dbclean.timer
+lib/systemd/system/dccifd.service
+usr/bin/cdcc
+usr/bin/dccif-test
+usr/bin/dccproc
+usr/lib/dcc/check_ip_range
+usr/lib/dcc/ck2ip
+usr/lib/dcc/cron-dccd
+usr/lib/dcc/dbclean
+usr/lib/dcc/dblist
+usr/lib/dcc/dcc-nagios
+usr/lib/dcc/dcc-stats-collect
+usr/lib/dcc/dcc-stats-graph
+usr/lib/dcc/dcc-stats-init
+usr/lib/dcc/dcc-stats-update
+usr/lib/dcc/dccd
+usr/lib/dcc/dccifd
+usr/lib/dcc/dccsight
+usr/lib/dcc/dns-helper
+usr/lib/dcc/dump-clients
+usr/lib/dcc/fetchblack
+usr/lib/dcc/fetchids
+usr/lib/dcc/fix-map
+usr/lib/dcc/hackmc
+usr/lib/dcc/list-clients
+usr/lib/dcc/logger
+usr/lib/dcc/newwebuser
+usr/lib/dcc/rcDCC
+usr/lib/dcc/start-dccd
+usr/lib/dcc/start-dccifd
+usr/lib/dcc/start-grey
+usr/lib/dcc/stats-get
+usr/lib/dcc/stop-dccd
+usr/lib/dcc/uninstalldcc
+usr/lib/dcc/updatedcc
+usr/lib/dcc/wlist
+usr/share/dcc/ids
+usr/share/dcc/map.txt
+usr/share/man/man8/cdcc.8*
+usr/share/man/man8/dbclean.8*
+usr/share/man/man8/dblist.8*
+usr/share/man/man8/dcc.8*
+usr/share/man/man8/dccd.8*
+usr/share/man/man8/dccifd.8*
+usr/share/man/man8/dccproc.8*
+usr/share/man/man8/dccsight.8*
+var/lib/dcc/cgi-bin usr/share/doc/dcc/examples
+var/lib/dcc/log
+var/lib/dcc/dcc_conf etc/dcc
+var/lib/dcc/flod etc/dcc
+var/lib/dcc/grey_flod etc/dcc
+var/lib/dcc/grey_whitelist etc/dcc
+var/lib/dcc/whiteclnt etc/dcc
+var/lib/dcc/whitecommon etc/dcc
+var/lib/dcc/whitelist etc/dcc
--- dcc-2.3.169.orig/debian/links
+++ dcc-2.3.169/debian/links
@@ -0,0 +1,9 @@
+etc/dcc/dcc_conf	var/lib/dcc/dcc_conf
+etc/dcc/flod		var/lib/dcc/flod
+etc/dcc/grey_flod	var/lib/dcc/grey_flod
+etc/dcc/grey_whitelist	var/lib/dcc/grey_whitelist
+etc/dcc/ids		var/lib/dcc/ids
+etc/dcc/map.txt		var/lib/dcc/map.txt
+etc/dcc/whiteclnt	var/lib/dcc/whiteclnt
+etc/dcc/whitecommon	var/lib/dcc/whitecommon
+etc/dcc/whitelist	var/lib/dcc/whitelist
--- dcc-2.3.169.orig/debian/postinst
+++ dcc-2.3.169/debian/postinst
@@ -0,0 +1,69 @@
+#!/bin/sh
+
+set -e
+
+. /usr/share/debconf/confmodule
+db_version 2.0
+
+case "$1" in
+configure)
+    # Create user
+    systemd-sysusers ${DPKG_ROOT:+--root="$DPKG_ROOT"} dcc.conf
+
+    # Set file permissions
+    db_get dcc/install-setuid
+    if [ "$RET" = true ]; then
+        owner=dcc:dcc
+        mode=4755
+    else
+        owner=root:root
+        mode=0755
+    fi
+    for i in /usr/bin/cdcc /usr/bin/dccproc /usr/lib/dcc/dccsight; do
+        if test -x $i; then
+            chown $owner $i
+            chmod $mode $i
+        fi
+    done
+
+    if test -d /var/lib/dcc; then
+        chown dcc:dcc /var/lib/dcc
+    fi
+
+    if test -d /var/lib/dcc/log; then
+        chown dcc:dcc /var/lib/dcc/log
+        chmod 0710 /var/lib/dcc/log
+    fi
+
+    # Create /etc/dcc/ids, /etc/dcc/map.txt and /var/lib/dcc/map
+    PASSWD1=`(date; dd if=/dev/urandom count=1 2>&1 || true) \
+        | cksum | tr '     ' xy`
+    PASSWD2=`(echo "$PASSWD1"; date; dd if=/dev/urandom count=1 2>&1 || true) \
+        | cksum | tr '     ' xy`
+    if ! test -s /etc/dcc/ids; then
+        touch /etc/dcc/ids
+        chown dcc:dcc /etc/dcc/ids
+        chmod 0600 /etc/dcc/ids
+        sed -e "/^[^#]/s/secret1[0-9a-z]*/secret1$PASSWD1/" \
+            -e "/^[^#]/s/secret2[0-9a-z]*/secret2$PASSWD2/" \
+            /usr/share/dcc/ids > /etc/dcc/ids
+    fi
+    if ! test -s /etc/dcc/map.txt; then
+        touch /etc/dcc/map.txt
+        chown dcc:dcc /etc/dcc/map.txt
+        chmod 0600 /etc/dcc/map.txt
+        sed -e "/^[^#]/s/secret1[0-9a-z]*/secret1$PASSWD1/" \
+            /usr/share/dcc/map.txt > /etc/dcc/map.txt
+    fi
+    if ! test -s /var/lib/dcc/map; then
+        cdcc -qh /var/lib/dcc 'new map; load -; info' \
+            < /etc/dcc/map.txt > /dev/null
+        chown dcc:dcc /var/lib/dcc/map
+        chmod 0600 /var/lib/dcc/map
+    fi
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0
--- dcc-2.3.169.orig/debian/rules
+++ dcc-2.3.169/debian/rules
@@ -0,0 +1,65 @@
+#!/usr/bin/make -f
+# vim: ft=make
+
+INSTALL = $(CURDIR)/debian/tmp
+SYSTEMD_VERSION = $(shell systemctl --version | head -n 1 | cut -d ' ' -f 2)
+UNITDIR = /lib/systemd/system
+TEMPLATE_VARS = \
+    --define libexecdir=/usr/lib/dcc \
+    --define homedir=/var/lib/dcc \
+    --define systemd_security=debian/systemd_security.tt \
+    --define systemd_version=$(SYSTEMD_VERSION)
+
+%:
+	dh $@
+
+.PHONY: patch
+patch:
+	# The postinst script creates the files ids, map.txt and map
+	sed -i.orig '/sh fix-map/d' homedir/Makefile.in
+	# Let libmilter/mfapi.h include stdbool.h
+	sed -i.orig '/^CFLAGS/s/$$/ -DSM_CONF_STDBOOL_H=1/' Makefile.inc.in
+
+override_dh_auto_configure: patch
+	FETCH_CMD=/usr/bin/wget \
+	HTPASSWD=/usr/bin/htpasswd \
+	NOTIFYMAILER=/usr/sbin/sendmail \
+	PERL=/usr/bin/perl \
+	RRDTOOL=/usr/bin/rrdtool \
+	CFLAGS="-DSM_CONF_STDBOOL_H=1" \
+	./configure \
+	    --bindir=/usr/bin \
+	    --libexecdir=/usr/lib/dcc \
+	    --mandir=/usr/share/man \
+	    --homedir=/var/lib/dcc \
+	    --with-cgi-bin=/var/lib/dcc/cgi-bin \
+	    --with-rundir=/run/dcc \
+	    --enable-pkg-make \
+	    --with-install-cmd=/usr/bin/install \
+	    --with-installroot=$(INSTALL) \
+	    --with-uid=dcc
+
+override_dh_auto_install:
+	make -j1 install DESTDIR=$(INSTALL)
+	dh_installsysusers
+
+override_dh_install:
+	# Install config templates and sendmail files
+	install -d $(INSTALL)/usr/share/dcc
+	install -m 0644 homedir/ids $(INSTALL)/usr/share/dcc/ids
+	install -m 0644 homedir/map.txt $(INSTALL)/usr/share/dcc/map.txt
+	install -m 0644 misc/*.m4 $(INSTALL)/usr/share/dcc/
+	# Install systemd unit files
+	install -d $(INSTALL)/$(UNITDIR)
+	for i in dbclean.timer dbclean.service dccifd.service dccm.service; do \
+	    tpage $(TEMPLATE_VARS) debian/$$i.tt > $(INSTALL)/$(UNITDIR)/$$i; \
+	done
+	# Install the software
+	dh_install
+
+override_dh_installchangelogs:
+	dh_installchangelogs CHANGES
+
+override_dh_installsystemd:
+	dh_installsystemd -pdcc dccifd.service
+	dh_installsystemd -pdcc-milter dccm.service
--- dcc-2.3.169.orig/debian/systemd_security.tt
+++ dcc-2.3.169/debian/systemd_security.tt
@@ -0,0 +1,36 @@
+[%# vim: set ft=tt2: -%]
+[% DEFAULT
+systemd_version = 0
+-%]
+CapabilityBoundingSet=
+DevicePolicy=closed
+NoNewPrivileges=yes
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
+SystemCallArchitectures=native
+[% IF systemd_version >= 235 -%]
+MemoryDenyWriteExecute=yes
+PrivateUsers=yes
+ProtectSystem=strict
+ReadWritePaths=[% homedir %]
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+[% END -%]
+[% IF systemd_version >= 245 -%]
+LockPersonality=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+RemoveIPC=yes
+RestrictSUIDSGID=yes
+SystemCallFilter=@system-service
+[% END -%]
+[% IF systemd_version >= 247 -%]
+ProtectProc=invisible
+ProcSubset=all
+[% END -%]
--- dcc-2.3.169.orig/debian/templates
+++ dcc-2.3.169/debian/templates
@@ -0,0 +1,7 @@
+Template: dcc/install-setuid
+Type: boolean
+Default: false
+Description: Should some executables be installed with setuid permissions?
+ The cdcc, dccproc and dccsight programs can be installed with the setuid bit
+ set, so that they will run with the permissions of the 'dcc' user. This is
+ only required if DCC will be run by ordinary users. If in doubt, say no.
