diff options
| author | Ryan Kavanagh <rak@rak.ac> | 2026-07-30 08:28:07 -0400 |
|---|---|---|
| committer | Ryan Kavanagh <rak@rak.ac> | 2026-07-30 08:28:07 -0400 |
| commit | 968130b5fe13b7684cb809f1e6c658b896573a52 (patch) | |
| tree | 01ed9e119ec0ae58fb3e2169f2619326a72cd514 | |
| parent | locale words (diff) | |
drop some restrictions on sbuild update
| -rw-r--r-- | dot_config/systemd/user/sbuild-update.service | 18 |
1 files changed, 0 insertions, 18 deletions
diff --git a/dot_config/systemd/user/sbuild-update.service b/dot_config/systemd/user/sbuild-update.service index 82c6bb3..2d93232 100644 --- a/dot_config/systemd/user/sbuild-update.service +++ b/dot_config/systemd/user/sbuild-update.service @@ -9,21 +9,3 @@ ExecStart=%h/.local/lib/sbuild/update-chroots.sh LimitNOFILE=131072 IOSchedulingClass=idle Nice=19 - -CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_CHOWN -IPAddressDeny=any -LockPersonality=true -MemoryDenyWriteExecute=true -NoNewPrivileges=true -PrivateTmp=true -PrivateDevices=true -PrivateNetwork=true -ProtectClock=true -ProtectControlGroups=true -ProtectHostname=true -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=true -RestrictRealtime=true -RestrictSUIDSGID=true -SystemCallArchitectures=native -SystemCallFilter=@system-service @chown |