diff options
| author | Lennart Poettering <lennart@poettering.net> | 2016-06-13 16:54:21 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-06-13 16:54:21 +0200 |
| commit | 9ea8e2ce85303bba2a15c7508b1eb905433ad62c (patch) | |
| tree | cd5d09b1832a12ca48391e50658d16c414739ca1 /units/systemd-machined.service.in | |
| parent | dcd61450026c281c916f12c2affa220e0994ba19 (diff) | |
| parent | 54a17e01de048a2275f8861b211f10d11e56407d (diff) | |
Merge pull request #3498 from poettering/syscall-filter-fixes
Syscall filter fixes, tighter nspawn seccomp sandbox by default
Diffstat (limited to 'units/systemd-machined.service.in')
| -rw-r--r-- | units/systemd-machined.service.in | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index 82dca05338..cd4a097f5a 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -18,7 +18,7 @@ BusName=org.freedesktop.machine1 CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD WatchdogSec=3min MemoryDenyWriteExecute=yes -SystemCallFilter=~@clock @module @mount @obsolete @raw-io ptrace +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io # Note that machined cannot be placed in a mount namespace, since it # needs access to the host's mount namespace in order to implement the |