portable: Set DelegateNamespaces=no for all portable profiles

We don't want to delegate any namespaces to portable services, so let's explicitly set DelegateNamespaces=no in the portable profiles.
2026-04-14 00:14:32 +09:00 · 2025-03-06 14:17:14 +01:00
parent 11b982053b
commit e533610375
3 changed files with 3 additions and 0 deletions
--- a/src/portable/profile/default/service.conf
+++ b/src/portable/profile/default/service.conf
@@ -24,6 +24,7 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
 RestrictNamespaces=yes
+DelegateNamespaces=no
 SystemCallFilter=@system-service
 SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
--- a/src/portable/profile/nonetwork/service.conf
+++ b/src/portable/profile/nonetwork/service.conf
@@ -22,6 +22,7 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
 RestrictNamespaces=yes
+DelegateNamespaces=no
 SystemCallFilter=@system-service
 SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
--- a/src/portable/profile/strict/service.conf
+++ b/src/portable/profile/strict/service.conf
@@ -20,6 +20,7 @@ NoNewPrivileges=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
 RestrictNamespaces=yes
+DelegateNamespaces=no
 SystemCallFilter=@system-service
 SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native