Merge pull request #182342 from veehaitch/github-runner-capset
nixos/github-runner: fix capset syscall filtering
This commit is contained in:
commit
2922becf6d
|
@ -300,7 +300,6 @@ in
|
|||
UMask = "0066";
|
||||
ProtectProc = "invisible";
|
||||
SystemCallFilter = [
|
||||
"~@capset"
|
||||
"~@clock"
|
||||
"~@cpu-emulation"
|
||||
"~@module"
|
||||
|
@ -308,6 +307,7 @@ in
|
|||
"~@obsolete"
|
||||
"~@raw-io"
|
||||
"~@reboot"
|
||||
"~capset"
|
||||
"~setdomainname"
|
||||
"~sethostname"
|
||||
];
|
||||
|
|
Loading…
Reference in a new issue