YunoHost-Apps/airsonic_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/airsonic_ynh.git synced 2024-09-03 18:06:14 +02:00
Code Issues Activity Actions

Disabling sandboxing

Browse source
This commit is contained in:
yalh76 2022-09-22 02:40:04 +02:00
parent 0d906fda70
commit f896e1c3fb
1 changed files with 14 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
conf/systemd.service
View file

@ -22,16 +22,16 @@ ExecStart=/usr/bin/java \
# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
# for details
DeviceAllow=char-alsa rw
NoNewPrivileges=yes
PrivateTmp=yes
PrivateUsers=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap
ReadWritePaths=__FINALPATH__
#DeviceAllow=char-alsa rw
#NoNewPrivileges=yes
#PrivateTmp=yes
#PrivateUsers=yes
#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
#RestrictNamespaces=yes
#RestrictRealtime=yes
#DevicePolicy=closed
#SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap
#ReadWritePaths=__FINALPATH__
# You can uncomment the following line if you're not using the jukebox
# This will prevent airsonic from accessing any real (physical) devices
@ -40,10 +40,10 @@ ReadWritePaths=__FINALPATH__
# You can change the following line to `strict` instead of `full`
# if you don't want airsonic to be able to
# write anything on your filesystem outside of AIRSONIC_HOME.
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
#ProtectSystem=full
#ProtectControlGroups=yes
#ProtectKernelModules=yes
#ProtectKernelTunables=yes
# You can uncomment the following line if you don't have any media
# in /home/…. This will prevent airsonic from ever reading/writing anything there.