nixos/prometheus: Enable CapabilityBoundingSet hardening

2025-12-17 09:39:06 +00:00
parent 46ce9a461e
commit e1e7ee899e
1 changed files with 1 additions and 0 deletions
@@ -1980,6 +1980,7 @@ in
        StateDirectory = cfg.stateDir;
        StateDirectoryMode = "0700";
        # Hardening
+        CapabilityBoundingSet = [ "" ];
        DeviceAllow = [ "/dev/null rw" ];
        DevicePolicy = "strict";
        LockPersonality = true;