nixos/navidrome: set proper SystemCallFilter

2022-10-24 22:21:59 +10:00
parent 7415970a3e
commit 0ce08acdce
1 changed files with 1 additions and 1 deletions
@@ -62,7 +62,7 @@ in {
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
        SystemCallArchitectures = "native";
-        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
        RestrictRealtime = true;
        LockPersonality = true;
        MemoryDenyWriteExecute = true;