diff options
| author | Lennart Poettering <lennart@poettering.net> | 2018-11-12 19:21:09 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2018-11-13 10:38:17 +0100 |
| commit | 99cd001d4c27c90cd9c0c66f88dc3673bb39ce73 (patch) | |
| tree | cd5e7997431990aaf922af7387a39e617c0f2b3a | |
| parent | cc9cc1b12648a31c82d7c6acfb16391c5af6150d (diff) | |
| download | systemd-99cd001d4c27c90cd9c0c66f88dc3673bb39ce73.tar.gz | |
units: also change portabled's syscall filter to a whitelist
| -rw-r--r-- | units/systemd-portabled.service.in | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/units/systemd-portabled.service.in b/units/systemd-portabled.service.in index a868f61dba..a44cdb30a4 100644 --- a/units/systemd-portabled.service.in +++ b/units/systemd-portabled.service.in @@ -20,7 +20,7 @@ CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_C MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service @mount SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any |