dustin
/
configpolicy
1
1
Fork 0
Code Issues Releases Activity

r/vmhost: Remove system call filters from unit 

The `vm-autostart` script fails with `bad system call` errors when
trying to start libvirt domains.  Removing the system call filters works
around this.  Ideally, we should figure out exactly which system call is
being rejected and allow it, but that's rather difficult to do and
probably not really worth the effort in this case.
frigate-exporter
Dustin 2024-01-21 15:53:44 -06:00
parent 823d899e9e
commit d5de7131a0
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
roles/vmhost/files/vm-autostart.service
View File

@ -37,8 +37,6 @@ RestrictNamespaces=yes
RestrictRealtime=yes RestrictRealtime=yes
RestrictSUIDSGID=yes RestrictSUIDSGID=yes
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
UMask=0027 UMask=0027
[Install] [Install]