nixos/gerrit: Enable MountAPIVFS hardening in service config

This setting is already implied by others, but add it for completeness as well. For documentation see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#MountAPIVFS= Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-05 15:38:50 +02:00
parent bf496bd1d2
commit 302eaedd92
1 changed files with 1 additions and 0 deletions
@@ -232,6 +232,7 @@ in
        AmbientCapabilities = "";
        CapabilityBoundingSet = "";
        LockPersonality = true;
+        MountAPIVFS = true;
        NoNewPrivileges = true;
        PrivateDevices = true;
        PrivateMounts = true;