BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

nixos/navidrome: set proper SystemCallFilter

Browse source
This commit is contained in:
MidAutumnMoon 2022-10-24 11:02:42 +08:00 committed by zowoq
parent 7415970a3e
commit 0ce08acdce
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/services/audio/navidrome.nix
View file

@ -62,7 +62,7 @@ in {
ProtectKernelModules = true;
ProtectKernelTunables = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
SystemCallFilter = [ "@system-service" "~@privileged" ];
RestrictRealtime = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;