SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

units/systemd-portabled: enable NoNewPrivileges=

Browse Source 
As with all other daemons we ship.
This commit is contained in:
Mike Yuan
2026-01-21 23:13:09 +01:00
committed by Daan De Meyer
parent a08cee5084
commit e9a1271a0c
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
units/systemd-portabled.service.in
+1
View File
@@ -20,6 +20,7 @@ ExecStart={{LIBEXECDIR}}/systemd-portabled
BusName=org.freedesktop.portable1
CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
ProtectHostname=yes
ProtectKernelLogs=yes
RestrictRealtime=yes
units/user/systemd-portabled.service.in
+1
View File
@@ -16,6 +16,7 @@ Documentation=man:org.freedesktop.portable1(5)
ExecStart={{LIBEXECDIR}}/systemd-portabled --user
BusName=org.freedesktop.portable1
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
SystemCallFilter=@system-service @mount