Ok, I figured this out.
So in your override-hardened.conf
you have the line
ProcSubset=pid
set. This line will cause procfs
to be mounted with the subset=pid
option. The subset=pid
option means that only /proc/<pid>
directories will be visible and no other procfs
files.
Consequently, the /run/systemd/unit-root/proc/sys/kernel/domainname
file will not be available to the synapse.service
. So in order to have a functioning service you will need to disable ProcSubset=pid
in your override-hardened.conf
. The subset=pid
mount option for procfs
will be available on reletaviely new kernels. Older kernels that do not support this option will work.