nixos/listmonk: set proper SystemCallFilter
This commit is contained in:
parent
ba8041fc2b
commit
d3a95ce32c
|
@ -202,7 +202,7 @@ in {
|
|||
NoNewPrivileges = true;
|
||||
CapabilityBoundingSet = "";
|
||||
SystemCallArchitecture = "native";
|
||||
SystemCallFilter = [ "@system-service" "~@privileged" "@resources" ];
|
||||
SystemCallFilter = [ "@system-service" "~@privileged" ];
|
||||
ProtectDevices = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectKernelTunables = true;
|
||||
|
|
Loading…
Reference in a new issue