Unverified Commit 0a5e37e1 authored by Martin Weinelt's avatar Martin Weinelt Committed by GitHub
Browse files

Merge pull request #246123 from mweinelt/matrix-appservice-syscall-filter-update

nixos/matrix-appservice-irc: update syscall filter
parents 424ed972 6ae8e133
Loading
Loading
Loading
Loading
+4 −1
Original line number Diff line number Diff line
@@ -215,7 +215,10 @@ in {
        LockPersonality = true;
        RestrictRealtime = true;
        PrivateMounts = true;
        SystemCallFilter = "~@aio @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @setuid @swap";
        SystemCallFilter = [
          "@system-service @pkey"
          "~@privileged @resources"
        ];
        SystemCallArchitectures = "native";
        # AF_UNIX is required to connect to a postgres socket.
        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";