units: also change portabled's syscall filter to a whitelist
This commit is contained in:
parent
cc9cc1b126
commit
99cd001d4c
|
@ -20,7 +20,7 @@ CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_C
|
||||||
MemoryDenyWriteExecute=yes
|
MemoryDenyWriteExecute=yes
|
||||||
RestrictRealtime=yes
|
RestrictRealtime=yes
|
||||||
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
|
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
|
||||||
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap
|
SystemCallFilter=@system-service @mount
|
||||||
SystemCallArchitectures=native
|
SystemCallArchitectures=native
|
||||||
LockPersonality=yes
|
LockPersonality=yes
|
||||||
IPAddressDeny=any
|
IPAddressDeny=any
|
||||||
|
|
Loading…
Reference in a new issue