From 968130b5fe13b7684cb809f1e6c658b896573a52 Mon Sep 17 00:00:00 2001
From: Ryan Kavanagh <rak@rak.ac>
Date: Thu, 30 Jul 2026 08:28:07 -0400
Subject: drop some restrictions on sbuild update

---
 dot_config/systemd/user/sbuild-update.service | 18 ------------------
 1 file changed, 18 deletions(-)

(limited to 'dot_config/systemd/user')

diff --git a/dot_config/systemd/user/sbuild-update.service b/dot_config/systemd/user/sbuild-update.service
index 82c6bb3..2d93232 100644
--- a/dot_config/systemd/user/sbuild-update.service
+++ b/dot_config/systemd/user/sbuild-update.service
@@ -9,21 +9,3 @@ ExecStart=%h/.local/lib/sbuild/update-chroots.sh
 LimitNOFILE=131072
 IOSchedulingClass=idle
 Nice=19
-
-CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_CHOWN
-IPAddressDeny=any
-LockPersonality=true
-MemoryDenyWriteExecute=true
-NoNewPrivileges=true
-PrivateTmp=true
-PrivateDevices=true
-PrivateNetwork=true
-ProtectClock=true
-ProtectControlGroups=true
-ProtectHostname=true
-RestrictAddressFamilies=AF_UNIX
-RestrictNamespaces=true
-RestrictRealtime=true
-RestrictSUIDSGID=true
-SystemCallArchitectures=native
-SystemCallFilter=@system-service @chown
-- 
cgit v1.2.3