Skip to content

Commit d98df5b

Browse files
committed
Merge branch 'PHP-7.4'
2 parents 4daa680 + ac042f8 commit d98df5b

File tree

1 file changed

+1
-4
lines changed

1 file changed

+1
-4
lines changed

sapi/fpm/php-fpm.service.in

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,6 @@ ProtectHome=true
2424
# Mounts the /usr, /boot, and /etc directories read-only for processes invoked by this unit.
2525
ProtectSystem=full
2626

27-
# Ensures that the service process and all its children can never gain new privileges
28-
NoNewPrivileges=true
29-
3027
# Sets up a new /dev namespace for the executed processes and only adds API pseudo devices
3128
# such as /dev/null, /dev/zero or /dev/random (as well as the pseudo TTY subsystem) to it,
3229
# but no physical devices such as /dev/sda.
@@ -55,7 +52,7 @@ RestrictRealtime=true
5552

5653
# Restricts the set of socket address families accessible to the processes of this unit.
5754
# Protects against vulnerabilities such as CVE-2016-8655
58-
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
55+
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
5956

6057
# Takes away the ability to create or manage any kind of namespace
6158
RestrictNamespaces=true

0 commit comments

Comments
 (0)