diff options
| author | Jakub Zelenka <bukka@php.net> | 2019-12-08 17:58:59 +0000 |
|---|---|---|
| committer | Jakub Zelenka <bukka@php.net> | 2019-12-08 17:58:59 +0000 |
| commit | d98df5b6c6251f70755673e282e7ecce1f90277b (patch) | |
| tree | d8a4778faea24dd6ff338219de8928de1394b246 | |
| parent | 4daa680512c010894e1954bff063a94935dc7931 (diff) | |
| parent | ac042f839f4c4a2b8241fa69f8f3b01766814f1e (diff) | |
| download | php-git-d98df5b6c6251f70755673e282e7ecce1f90277b.tar.gz | |
Merge branch 'PHP-7.4'
| -rw-r--r-- | sapi/fpm/php-fpm.service.in | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/sapi/fpm/php-fpm.service.in b/sapi/fpm/php-fpm.service.in index f58ea08af8..eab81300b7 100644 --- a/sapi/fpm/php-fpm.service.in +++ b/sapi/fpm/php-fpm.service.in @@ -24,9 +24,6 @@ ProtectHome=true # Mounts the /usr, /boot, and /etc directories read-only for processes invoked by this unit. ProtectSystem=full -# Ensures that the service process and all its children can never gain new privileges -NoNewPrivileges=true - # Sets up a new /dev namespace for the executed processes and only adds API pseudo devices # such as /dev/null, /dev/zero or /dev/random (as well as the pseudo TTY subsystem) to it, # but no physical devices such as /dev/sda. @@ -55,7 +52,7 @@ RestrictRealtime=true # Restricts the set of socket address families accessible to the processes of this unit. # Protects against vulnerabilities such as CVE-2016-8655 -RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX # Takes away the ability to create or manage any kind of namespace RestrictNamespaces=true |