nixos/matrix-appservice-irc: update syscall filter
Simplify the SystemcallFilter by employing an explicit allow list, and an explicit block list. Node since version 18 requires syscalls in the @pkey group. Excluding @privileged and @resources is a recommendation in systemd-analyze.
This commit is contained in:
parent
ddfe5282c8
commit
6ae8e13396
|
@ -215,7 +215,10 @@ in {
|
|||
LockPersonality = true;
|
||||
RestrictRealtime = true;
|
||||
PrivateMounts = true;
|
||||
SystemCallFilter = "~@aio @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @setuid @swap";
|
||||
SystemCallFilter = [
|
||||
"@system-service @pkey"
|
||||
"~@privileged @resources"
|
||||
];
|
||||
SystemCallArchitectures = "native";
|
||||
# AF_UNIX is required to connect to a postgres socket.
|
||||
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
|
||||
|
|
Loading…
Reference in a new issue