mirror of
https://github.com/SebastianWendel/nixpkgs.git
synced 2024-09-23 21:55:53 +02:00
nixos/yggdrasil: set proper SystemCallFilter
This commit is contained in:
parent
ae025da558
commit
7742cd543d
|
@ -180,7 +180,7 @@ in {
|
|||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources";
|
||||
SystemCallFilter = [ "@system-service" "~@privileged @keyring" ];
|
||||
} // (if (cfg.group != null) then {
|
||||
Group = cfg.group;
|
||||
} else {});
|
||||
|
|
Loading…
Reference in a new issue