public/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-07-08 00:50:20 +09:00
Code Issues Packages Projects Releases Wiki Activity

Remove CAP_CHOWN from systemd service

Browse Source
This commit is contained in:
Florian Preinstorfer
2026-06-21 17:30:53 +02:00
committed by nblock
parent 3846c3f148
commit 6e6ea3758d
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packaging/systemd/headscale.service
+2 -3
View File
@@ -14,8 +14,8 @@ RestartSec=5
WorkingDirectory=/var/lib/headscale
ReadWritePaths=/var/lib/headscale
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_CHOWN
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
LockPersonality=true
NoNewPrivileges=true
PrivateDevices=true
@@ -41,7 +41,6 @@ RuntimeDirectoryMode=0750
StateDirectory=headscale
StateDirectoryMode=0750
SystemCallArchitectures=native
SystemCallFilter=@chown
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
UMask=0077