Dustin C. Hatch
d5de7131a0
The `vm-autostart` script fails with `bad system call` errors when trying to start libvirt domains. Removing the system call filters works around this. Ideally, we should figure out exactly which system call is being rejected and allow it, but that's rather difficult to do and probably not really worth the effort in this case.
44 lines
873 B
Desktop File
44 lines
873 B
Desktop File
[Unit]
|
|
Description=Start virtual machines
|
|
After=libvirt.service
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
Environment=LIBVIRT_DEFAULT_URI=qemu:///system
|
|
ExecStart=/usr/local/libexec/vm-autostart.sh
|
|
Restart=on-failure
|
|
|
|
DynamicUser=yes
|
|
SupplementaryGroups=libvirt
|
|
CapabilityBoundingSet=
|
|
DeviceAllow=
|
|
DevicePolicy=closed
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateUsers=yes
|
|
PrivateTmp=yes
|
|
ProcSubset=pid
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
RestrictAddressFamilies=
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
SystemCallArchitectures=native
|
|
UMask=0027
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|