From c05877ea266635d373b9969818668e6b9cd07d33 Mon Sep 17 00:00:00 2001
From: OniriCorpe <oniricorpe@disroot.org>
Date: Thu, 23 May 2024 00:36:21 +0200
Subject: [PATCH] remove '@setuid' from 'SystemCallFilter'

---
 conf/systemd.service | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conf/systemd.service b/conf/systemd.service
index 6e0b50d..d642817 100644
--- a/conf/systemd.service
+++ b/conf/systemd.service
@@ -30,7 +30,7 @@ ProtectKernelModules=yes
 ProtectKernelTunables=yes
 LockPersonality=yes
 SystemCallArchitectures=native
-SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @swap @cpu-emulation
 
 # Denying access to capabilities that should not be relevant for webapps
 # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html