dustin/configpolicy
1
1
Fork 0
Code Issues Releases Activity

r/vmhost: Remove system call filters from unit

Browse Source 
The `vm-autostart` script fails with `bad system call` errors when
trying to start libvirt domains.  Removing the system call filters works
around this.  Ideally, we should figure out exactly which system call is
being rejected and allow it, but that's rather difficult to do and
probably not really worth the effort in this case.
This commit is contained in:
Dustin
2024-01-21 15:53:44 -06:00
parent 823d899e9e
commit d5de7131a0
1 changed files with 0 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/vmhost/files/vm-autostart.service
View File

@@ -37,8 +37,6 @@ RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
UMask=0027
[Install]