ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-11-10 16:45:51 +03:00
Code Issues Projects Releases Wiki Activity

nixos/geoipupdate: set proper SystemCallFilter

Browse Source
This commit is contained in:
MidAutumnMoon 2022-10-25 16:45:49 +08:00
parent 4fffb0e5fe
commit f4342c11e5
No known key found for this signature in database
GPG Key ID: 3B9D690FD7E4664A
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/services/misc/geoipupdate.nix
View File

@ -197,7 +197,7 @@ in
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProcSubset = "pid";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
SystemCallFilter = [ "@system-service" "~@privileged" ];
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictRealtime = true;
RestrictNamespaces = true;