b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

nixos/geoipupdate: set proper SystemCallFilter

Browse source
This commit is contained in:
MidAutumnMoon 2022-10-25 16:45:49 +08:00
parent 4fffb0e5fe
commit f4342c11e5
No known key found for this signature in database
GPG key ID: 3B9D690FD7E4664A
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/services/misc/geoipupdate.nix
View file

@ -197,7 +197,7 @@ in
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProcSubset = "pid";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
SystemCallFilter = [ "@system-service" "~@privileged" ];
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictRealtime = true;
RestrictNamespaces = true;