templates/systemd/mastodon: update sandbox mode (#16103)

master
Yurii Izorkin 3 years ago committed by GitHub
parent f4b7c6b619
commit 863ae47b51
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
  1. 2
      dist/mastodon-sidekiq.service
  2. 2
      dist/mastodon-streaming.service
  3. 2
      dist/mastodon-web.service

@ -38,7 +38,7 @@ PrivateMounts=true
ProtectClock=true ProtectClock=true
# System Call Filtering # System Call Filtering
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

@ -38,7 +38,7 @@ PrivateMounts=true
ProtectClock=true ProtectClock=true
# System Call Filtering # System Call Filtering
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

@ -38,7 +38,7 @@ PrivateMounts=true
ProtectClock=true ProtectClock=true
# System Call Filtering # System Call Filtering
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

Loading…
Cancel
Save