mirror of
https://github.com/YunoHost-Apps/airsonic_ynh.git
synced 2024-09-03 18:06:14 +02:00
Disabling sandboxing
This commit is contained in:
parent
0d906fda70
commit
f896e1c3fb
1 changed files with 14 additions and 14 deletions
|
@ -22,16 +22,16 @@ ExecStart=/usr/bin/java \
|
||||||
|
|
||||||
# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
|
# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
|
||||||
# for details
|
# for details
|
||||||
DeviceAllow=char-alsa rw
|
#DeviceAllow=char-alsa rw
|
||||||
NoNewPrivileges=yes
|
#NoNewPrivileges=yes
|
||||||
PrivateTmp=yes
|
#PrivateTmp=yes
|
||||||
PrivateUsers=yes
|
#PrivateUsers=yes
|
||||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||||
RestrictNamespaces=yes
|
#RestrictNamespaces=yes
|
||||||
RestrictRealtime=yes
|
#RestrictRealtime=yes
|
||||||
DevicePolicy=closed
|
#DevicePolicy=closed
|
||||||
SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap
|
#SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap
|
||||||
ReadWritePaths=__FINALPATH__
|
#ReadWritePaths=__FINALPATH__
|
||||||
|
|
||||||
# You can uncomment the following line if you're not using the jukebox
|
# You can uncomment the following line if you're not using the jukebox
|
||||||
# This will prevent airsonic from accessing any real (physical) devices
|
# This will prevent airsonic from accessing any real (physical) devices
|
||||||
|
@ -40,10 +40,10 @@ ReadWritePaths=__FINALPATH__
|
||||||
# You can change the following line to `strict` instead of `full`
|
# You can change the following line to `strict` instead of `full`
|
||||||
# if you don't want airsonic to be able to
|
# if you don't want airsonic to be able to
|
||||||
# write anything on your filesystem outside of AIRSONIC_HOME.
|
# write anything on your filesystem outside of AIRSONIC_HOME.
|
||||||
ProtectSystem=full
|
#ProtectSystem=full
|
||||||
ProtectControlGroups=yes
|
#ProtectControlGroups=yes
|
||||||
ProtectKernelModules=yes
|
#ProtectKernelModules=yes
|
||||||
ProtectKernelTunables=yes
|
#ProtectKernelTunables=yes
|
||||||
|
|
||||||
# You can uncomment the following line if you don't have any media
|
# You can uncomment the following line if you don't have any media
|
||||||
# in /home/…. This will prevent airsonic from ever reading/writing anything there.
|
# in /home/…. This will prevent airsonic from ever reading/writing anything there.
|
||||||
|
|
Loading…
Add table
Reference in a new issue