mirror of
https://github.com/jellyfin/jellyfin.git
synced 2024-09-06 22:07:13 -04:00
Merge pull request #6778 from jvoisin/patch-1
Add a bit of hardening to the systemd service
This commit is contained in:
commit
b217f84d50
22
debian/jellyfin.service
vendored
22
debian/jellyfin.service
vendored
@ -10,5 +10,27 @@ ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELL
|
|||||||
Restart = on-failure
|
Restart = on-failure
|
||||||
TimeoutSec = 15
|
TimeoutSec = 15
|
||||||
|
|
||||||
|
NoNewPrivileges=true
|
||||||
|
SystemCallArchitectures=native
|
||||||
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
||||||
|
ProtectKernelModules=True
|
||||||
|
SystemCallFilter=~@clock
|
||||||
|
SystemCallFilter=~@aio
|
||||||
|
SystemCallFilter=~@chown
|
||||||
|
SystemCallFilter=~@cpu-emulation
|
||||||
|
SystemCallFilter=~@debug
|
||||||
|
SystemCallFilter=~@keyring
|
||||||
|
SystemCallFilter=~@memlock
|
||||||
|
SystemCallFilter=~@module
|
||||||
|
SystemCallFilter=~@mount
|
||||||
|
SystemCallFilter=~@obsolete
|
||||||
|
SystemCallFilter=~@privileged
|
||||||
|
SystemCallFilter=~@raw-io
|
||||||
|
SystemCallFilter=~@reboot
|
||||||
|
SystemCallFilter=~@setuid
|
||||||
|
SystemCallFilter=~@swap
|
||||||
|
SystemCallErrorNumber=EPERM
|
||||||
|
|
||||||
|
|
||||||
[Install]
|
[Install]
|
||||||
WantedBy = multi-user.target
|
WantedBy = multi-user.target
|
||||||
|
Loading…
Reference in New Issue
Block a user