module tweaks

This commit is contained in:
Robin Appelman 2026-05-31 16:23:45 +02:00
commit 78117b0d68
3 changed files with 6 additions and 7 deletions

View file

@ -90,11 +90,10 @@ in {
ProtectHostname = true;
LockPersonality = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = "AF_INET AF_INET6";
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_NETLINK"];
RestrictRealtime = true;
ProtectProc = "noaccess";
SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
IPAddressDeny = "localhost link-local multicast";
};
};