Remove some hardening options

To strict options prevent different services from running. It's
better to test these options and include them in specific roles.

templates/systemd/php-fpm@.service

@@ -26,15 +26,13 @@ RestartSec=30s
 
 # Hardening
 # https://github.com/php/php-src/blob/master/sapi/fpm/php-fpm.service.in
-LockPersonality=true
-NoNewPrivileges=true
 PrivateDevices=true
 PrivateTmp=true
 ProtectClock=true
 ProtectControlGroups=true
 ProtectKernelModules=true
 ProtectKernelTunables=true
-ProtectSystem=strict
+ProtectSystem=full
 RestrictRealtime=true
 RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
 RestrictNamespaces=true
@@ -42,12 +40,6 @@ SystemCallArchitectures=native
 SystemCallErrorNumber=EPERM
 SystemCallFilter=@system-service
 
-ReadWritePaths=-/var/log/
-ReadWritePaths=-{{ php_fpm_log_dir }}/
-ReadWritePaths=-/var/run/
-ReadWritePaths=-/run/
-InaccessiblePaths=-/root/
-
 # Resources
 CPUQuota={{ php_fpm_cpu_quota }}
 MemoryHigh={{ php_fpm_memory_high }}