diff options
| author | Claire <claire.github-309c@sitedethib.com> | 2021-10-25 21:31:10 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-10-25 21:31:10 +0200 |
| commit | e0f39626973fd9f5cce2d4cd3b166fb47e9c9059 (patch) | |
| tree | e02d1e9a448960a68652f75baebb5921211ee7a1 /dist/mastodon-streaming.service | |
| parent | c647fa99cab9b9db81d36223cf2c2c27e065b648 (diff) | |
| parent | a30ac454b2ceb381c50f5b9323e25817d784a476 (diff) | |
Merge pull request #1625 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes
Diffstat (limited to 'dist/mastodon-streaming.service')
| -rw-r--r-- | dist/mastodon-streaming.service | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/dist/mastodon-streaming.service b/dist/mastodon-streaming.service index 0befc529a..6d71298a5 100644 --- a/dist/mastodon-streaming.service +++ b/dist/mastodon-streaming.service @@ -12,6 +12,9 @@ Environment="STREAMING_CLUSTER_NUM=1" ExecStart=/usr/bin/node ./streaming TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -34,11 +37,14 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @memlock @mount @obsolete @privileged @resources @setuid +SystemCallFilter=pipe +SystemCallFilter=pipe2 [Install] WantedBy=multi-user.target |