From 137d392acc93f44625951363c7dd45421784137e Mon Sep 17 00:00:00 2001 From: Alexey Avramov Date: Thu, 3 Oct 2019 00:01:59 +0900 Subject: [PATCH] update nohang.service --- nohang/nohang.service.in | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nohang/nohang.service.in b/nohang/nohang.service.in index 4ab1605..2b2d53b 100644 --- a/nohang/nohang.service.in +++ b/nohang/nohang.service.in @@ -15,9 +15,10 @@ RestrictRealtime=yes MemoryDenyWriteExecute=yes ProtectKernelModules=true SystemCallArchitectures=native -SystemCallFilter=~@mount ReadOnlyPaths=/ ReadWritePaths=/tmp /var /run /dev/shm +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_LINUX_IMMUTABLE CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_TIME CAP_SYS_RESOURCE CAP_BLOCK_SUSPEND CAP_NET_ADMIN CAP_MKNOD CAP_AUDIT_CONTROL +AmbientCapabilities=~CAP_SYS_ADMIN CAP_LINUX_IMMUTABLE CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_TIME CAP_SYS_RESOURCE CAP_BLOCK_SUSPEND CAP_NET_ADMIN CAP_MKNOD CAP_AUDIT_CONTROL [Install] WantedBy=multi-user.target