File tree Expand file tree Collapse file tree 1 file changed +1
-4
lines changed Expand file tree Collapse file tree 1 file changed +1
-4
lines changed Original file line number Diff line number Diff line change @@ -24,9 +24,6 @@ ProtectHome=true
24
24
# Mounts the /usr, /boot, and /etc directories read-only for processes invoked by this unit.
25
25
ProtectSystem=full
26
26
27
- # Ensures that the service process and all its children can never gain new privileges
28
- NoNewPrivileges=true
29
-
30
27
# Sets up a new /dev namespace for the executed processes and only adds API pseudo devices
31
28
# such as /dev/null, /dev/zero or /dev/random (as well as the pseudo TTY subsystem) to it,
32
29
# but no physical devices such as /dev/sda.
@@ -55,7 +52,7 @@ RestrictRealtime=true
55
52
56
53
# Restricts the set of socket address families accessible to the processes of this unit.
57
54
# Protects against vulnerabilities such as CVE-2016-8655
58
- RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
55
+ RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
59
56
60
57
# Takes away the ability to create or manage any kind of namespace
61
58
RestrictNamespaces=true
You can’t perform that action at this time.
0 commit comments