From 863ae47b5145e53c6cc820bd7eff0efd41339e03 Mon Sep 17 00:00:00 2001 From: Yurii Izorkin Date: Sat, 24 Apr 2021 14:41:03 +0300 Subject: [PATCH] templates/systemd/mastodon: update sandbox mode (#16103) --- dist/mastodon-sidekiq.service | 2 +- dist/mastodon-streaming.service | 2 +- dist/mastodon-web.service | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dist/mastodon-sidekiq.service b/dist/mastodon-sidekiq.service index 0bb0a800f..e171475b5 100644 --- a/dist/mastodon-sidekiq.service +++ b/dist/mastodon-sidekiq.service @@ -38,7 +38,7 @@ PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap [Install] WantedBy=multi-user.target diff --git a/dist/mastodon-streaming.service b/dist/mastodon-streaming.service index 1443ca1c8..0befc529a 100644 --- a/dist/mastodon-streaming.service +++ b/dist/mastodon-streaming.service @@ -38,7 +38,7 @@ PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap [Install] WantedBy=multi-user.target diff --git a/dist/mastodon-web.service b/dist/mastodon-web.service index 3383f33e3..fd9e28770 100644 --- a/dist/mastodon-web.service +++ b/dist/mastodon-web.service @@ -38,7 +38,7 @@ PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap +SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap [Install] WantedBy=multi-user.target