nixos/jenkins: Set ProtectSystem to strict (#472066)

2026-03-16 09:44:48 +00:00
parent a499dfba7b 81e2494e18
commit fdf74752b4
1 changed files with 4 additions and 1 deletions
@@ -275,7 +275,10 @@ in
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
        ProtectProc = "invisible";
-        ProtectSystem = "full";
+        ProtectSystem = "strict";
+        ReadWritePaths = [
+          cfg.home
+        ];
        RemoveIPC = true;
        RestrictAddressFamilies = [
          "AF_UNIX"