systemd unit file: ensures that the process and all its children can never gain

new privileges (#12939).
2024-12-06 19:41:15 +01:00 · 2014-08-27 03:18:26 +00:00
parent b159ffb675
commit b4170421cc
1 changed files with 1 additions and 0 deletions
@@ -19,6 +19,7 @@ PrivateTmp = yes
 DeviceAllow = /dev/null rw
 DeviceAllow = /dev/urandom r
 InaccessibleDirectories = /home
+NoNewPrivileges = yes

 [Install]
 WantedBy = multi-user.target