Backupppert/jellyfin
0
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.git synced 2024-07-21 05:00:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6953 from matthiasdv/mdv/harden-systemd-service

Browse source 
Add more hardening to systemd service
This commit is contained in:
Claus Vium 2021-12-07 19:46:45 +01:00 committed by GitHub
parent 9cafa2cab4 3176a4ddd9
commit dd8b9e9d23
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
debian/jellyfin.service vendored
View file

@ -13,7 +13,20 @@ TimeoutSec = 15
NoNewPrivileges=true
SystemCallArchitectures=native
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
ProtectKernelModules=True
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
ProtectClock=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
LockPersonality=true
PrivateTmp=true
PrivateDevices=false
PrivateUsers=true
RemoveIPC=true
SystemCallFilter=~@clock
SystemCallFilter=~@aio
SystemCallFilter=~@chown