fix(systemd): let the WireGuard kernel TUN write rp_filter under the sandbox

ProtectKernelTunables=yes (#6718) mounts all of /proc/sys read-only, and a
WireGuard outbound in kernel-TUN mode zeroes net.ipv4.conf.all.rp_filter (and
its ipv6 and per-device siblings) while Xray creates its handlers, so the core
aborted with "failed to disable ipv4 rp_filter for all: ... read-only file
system". The unit is reinstalled on every update, so a hand edit did not stick.

Keep ProtectKernelTunables and reopen only /proc/sys/net. Turning the
protection off (#6797) also lets the core start, but leaves kernel.core_pattern
writable to the root panel, which turns any panel-level code execution into a
way out of the whole sandbox. net.* is per network namespace and grants nothing
beyond the CAP_NET_ADMIN the panel already holds.

Verified on systemd 257 (Debian trixie) with the shipped unit and the pinned
core: the v3.10.0 unit reproduces the error, the new one starts the kernel TUN,
and kernel.core_pattern stays read-only for the service.

Closes #6796

x-ui.service.arch

@@ -50,6 +50,10 @@ ProtectSystem=full
 # alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable.
 ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
 ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
+# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts
+# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only.
+# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232.
+ReadWritePaths=-/proc/sys/net
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes

x-ui.service.debian

@@ -50,6 +50,10 @@ ProtectSystem=full
 # alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable.
 ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
 ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
+# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts
+# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only.
+# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232.
+ReadWritePaths=-/proc/sys/net
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes

x-ui.service.rhel

@@ -50,6 +50,10 @@ ProtectSystem=full
 # alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable.
 ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
 ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
+# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts
+# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only.
+# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232.
+ReadWritePaths=-/proc/sys/net
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes