YunoHost-Apps/airsonic_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/airsonic_ynh.git synced 2024-09-03 18:06:14 +02:00
Code Issues Activity Actions

Disabling sandboxing

Browse source
This commit is contained in:
yalh76 2022-09-22 02:40:04 +02:00
parent 0d906fda70
commit f896e1c3fb
1 changed files with 14 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
conf/systemd.service
View file

@ -22,16 +22,16 @@ ExecStart=/usr/bin/java \
# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html # See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
# for details # for details
DeviceAllow=char-alsa rw #DeviceAllow=char-alsa rw
NoNewPrivileges=yes #NoNewPrivileges=yes
PrivateTmp=yes #PrivateTmp=yes
PrivateUsers=yes #PrivateUsers=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 #RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes #RestrictNamespaces=yes
RestrictRealtime=yes #RestrictRealtime=yes
DevicePolicy=closed #DevicePolicy=closed
SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap #SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap
ReadWritePaths=__FINALPATH__ #ReadWritePaths=__FINALPATH__
# You can uncomment the following line if you're not using the jukebox # You can uncomment the following line if you're not using the jukebox
# This will prevent airsonic from accessing any real (physical) devices # This will prevent airsonic from accessing any real (physical) devices
@ -40,10 +40,10 @@ ReadWritePaths=__FINALPATH__
# You can change the following line to `strict` instead of `full` # You can change the following line to `strict` instead of `full`
# if you don't want airsonic to be able to # if you don't want airsonic to be able to
# write anything on your filesystem outside of AIRSONIC_HOME. # write anything on your filesystem outside of AIRSONIC_HOME.
ProtectSystem=full #ProtectSystem=full
ProtectControlGroups=yes #ProtectControlGroups=yes
ProtectKernelModules=yes #ProtectKernelModules=yes
ProtectKernelTunables=yes #ProtectKernelTunables=yes
# You can uncomment the following line if you don't have any media # You can uncomment the following line if you don't have any media
# in /home/…. This will prevent airsonic from ever reading/writing anything there. # in /home/…. This will prevent airsonic from ever reading/writing anything there.