morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 00:14:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

units: also change portabled's syscall filter to a whitelist

Browse Source
This commit is contained in:
Lennart Poettering
2018-11-12 19:21:09 +01:00
parent cc9cc1b126
commit 99cd001d4c
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
units/systemd-portabled.service.in
View File

@@ -20,7 +20,7 @@ CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_C
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap
SystemCallFilter=@system-service @mount
SystemCallArchitectures=native
LockPersonality=yes
IPAddressDeny=any