tobias/garage_ynh
1
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

change systemd file if virtualisation is enabled

Browse Source
This commit is contained in:
oiseauroch
2022-12-22 16:14:33 +01:00
parent 827c9425b0
commit ff6be76e85
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
conf/systemd.service
View File

@@ -17,16 +17,16 @@ StandardError=inherit
# Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
PrivateTmp=yes
__VIRT_PROTECTION__PrivateTmp=yes
#PrivateDevices=yes
# RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
#DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
__VIRT_PROTECTION__ProtectSystem=full
__VIRT_PROTECTION__ProtectControlGroups=yes
#ProtectKernelModules=yes
ProtectKernelTunables=yes
__VIRT_PROTECTION__ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap