From 6121623940fe799f6f87b9610bc8d27faf76fc81 Mon Sep 17 00:00:00 2001 From: tituspijean Date: Sun, 4 Sep 2022 12:19:26 +0200 Subject: [PATCH] Tune systemd restrictions to allow USB and network communication --- conf/systemd.service | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/conf/systemd.service b/conf/systemd.service index e0b498e..e53c8e1 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -18,7 +18,8 @@ StandardError=inherit # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html NoNewPrivileges=yes PrivateTmp=yes -PrivateDevices=yes +# Remove to allow the app to talk to USB devices +#PrivateDevices=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK RestrictNamespaces=yes RestrictRealtime=yes @@ -28,7 +29,8 @@ ProtectControlGroups=yes ProtectKernelModules=yes ProtectKernelTunables=yes LockPersonality=yes -SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap +# @setuid removed from the list because it is needed by some network utilities (ping) +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @swap # Denying access to capabilities that should not be relevant for webapps # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html