movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-08 11:35:37 +03:00
Code Activity

nixos/github-runner: fix capset syscall filtering

Browse source 
capset(2) is a single system call, not a set of multiple system calls.
This commit is contained in:
Vincent Haupert 2022-07-21 16:08:15 +02:00
parent e3a3abe560
commit 539b61ea37
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/services/continuous-integration/github-runner.nix
View file

@ -300,7 +300,6 @@ in
UMask = "0066";
ProtectProc = "invisible";
SystemCallFilter = [
"~@capset"
"~@clock"
"~@cpu-emulation"
"~@module"
@ -308,6 +307,7 @@ in
"~@obsolete"
"~@raw-io"
"~@reboot"
"~capset"
"~setdomainname"
"~sethostname"
];