Merge pull request #122825 from Izorkin/update-duplicates-systemcallfilters
treewide: remove duplicates SystemCallFilters
commitb900661f6e26d9822a0bbc0e6b7b86c64cf816b3
authorJörg Thalheim <Mic92@users.noreply.github.com>
dateMon 17 May 2021, 12:06 (6 years ago)
parent70b37f9feebe40
nixos/modules/services/databases/redis.nix+1−1
@@ -331,7 +331,7 @@ in {
331331 PrivateMounts = true;
332332 # System Call Filtering
333333 SystemCallArchitectures = "native";
334− SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap";
334+ SystemCallFilter = "~@cpu-emulation @debug @keyring @memlock @mount @obsolete @privileged @resources @setuid";
335335 };
336336 };
337337 };
nixos/modules/services/misc/jellyfin.nix+1−3
@@ -92,9 +92,7 @@ in
9292 SystemCallErrorNumber = "EPERM";
9393 SystemCallFilter = [
9494 "@system-service"
95−
96− "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@module"
97− "~@obsolete" "~@privileged" "~@setuid"
95+ "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
9896 ];
9997 };
10098 };
nixos/modules/services/network-filesystems/samba-wsdd.nix+1−1
@@ -117,7 +117,7 @@ in {
117117 PrivateMounts = true;
118118 # System Call Filtering
119119 SystemCallArchitectures = "native";
120− SystemCallFilter = "~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @resources @swap";
120+ SystemCallFilter = "~@cpu-emulation @debug @mount @obsolete @privileged @resources";
121121 };
122122 };
123123 };
nixos/modules/services/networking/croc.nix+1−3
@@ -72,9 +72,7 @@ in
7272 RuntimeDirectoryMode = "700";
7373 SystemCallFilter = [
7474 "@system-service"
75− "~@aio" "~@chown" "~@keyring" "~@memlock"
76− "~@privileged" "~@resources" "~@setuid"
77− "~@sync" "~@timer"
75+ "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@setuid" "~@sync" "~@timer"
7876 ];
7977 SystemCallArchitectures = "native";
8078 SystemCallErrorNumber = "EPERM";
nixos/modules/services/web-apps/shiori.nix+1−4
@@ -86,10 +86,7 @@ in {
8686 SystemCallErrorNumber = "EPERM";
8787 SystemCallFilter = [
8888 "@system-service"
89−
90− "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock"
91− "~@module" "~@obsolete" "~@privileged" "~@raw-io"
92− "~@resources" "~@setuid"
89+ "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@resources" "~@setuid"
9390 ];
9491 };
9592 };
nixos/modules/services/web-servers/nginx/default.nix+1−1
@@ -859,7 +859,7 @@ in
859859 PrivateMounts = true;
860860 # System Call Filtering
861861 SystemCallArchitectures = "native";
862− SystemCallFilter = "~@chown @cpu-emulation @debug @keyring @ipc @module @mount @obsolete @privileged @raw-io @reboot @setuid @swap";
862+ SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid";
863863 };
864864 };
865865