From f6865fb40c6e6bf150aa81d1e35890fcd34a456b Mon Sep 17 00:00:00 2001
From: Florian Preinstorfer <site-github@nblock.org>
Date: Mon, 22 Jun 2026 11:46:17 +0200
Subject: [PATCH] Filter @resources from the list of allowed syscalls

---
 packaging/systemd/headscale.service | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packaging/systemd/headscale.service b/packaging/systemd/headscale.service
index 6881b290..9d3b6971 100644
--- a/packaging/systemd/headscale.service
+++ b/packaging/systemd/headscale.service
@@ -45,6 +45,7 @@ StateDirectoryMode=0750
 SystemCallArchitectures=native
 SystemCallFilter=@system-service
 SystemCallFilter=~@privileged
+SystemCallFilter=~@resources
 UMask=0077
 
 [Install]