Merge pull request #6985 from joshuaboniface/unharden-for-lxc
This commit is contained in:
commit
464ebf93dd
2
debian/conf/jellyfin
vendored
2
debian/conf/jellyfin
vendored
|
@ -44,6 +44,8 @@ JELLYFIN_ADDITIONAL_OPTS=""
|
|||
#
|
||||
# SysV init/Upstart options
|
||||
#
|
||||
# Note: These options are ignored by systemd; use /etc/systemd/system/jellyfin.d overrides instead.
|
||||
#
|
||||
|
||||
# Application username
|
||||
JELLYFIN_USER="jellyfin"
|
||||
|
|
16
debian/jellyfin.service
vendored
16
debian/jellyfin.service
vendored
|
@ -6,23 +6,26 @@ After = network-online.target
|
|||
Type = simple
|
||||
EnvironmentFile = /etc/default/jellyfin
|
||||
User = jellyfin
|
||||
Group = jellyfin
|
||||
WorkingDirectory = /var/lib/jellyfin
|
||||
ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS}
|
||||
Restart = on-failure
|
||||
TimeoutSec = 15
|
||||
SuccessExitStatus=0 143
|
||||
|
||||
NoNewPrivileges=true
|
||||
SystemCallArchitectures=native
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
||||
RestrictNamespaces=true
|
||||
RestrictNamespaces=false
|
||||
RestrictRealtime=true
|
||||
RestrictSUIDSGID=true
|
||||
ProtectControlGroups=true
|
||||
ProtectControlGroups=false
|
||||
ProtectHostname=true
|
||||
ProtectKernelLogs=true
|
||||
ProtectKernelModules=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelLogs=false
|
||||
ProtectKernelModules=false
|
||||
ProtectKernelTunables=false
|
||||
LockPersonality=true
|
||||
PrivateTmp=true
|
||||
PrivateTmp=false
|
||||
PrivateDevices=false
|
||||
PrivateUsers=true
|
||||
RemoveIPC=true
|
||||
|
@ -43,6 +46,5 @@ SystemCallFilter=~@setuid
|
|||
SystemCallFilter=~@swap
|
||||
SystemCallErrorNumber=EPERM
|
||||
|
||||
|
||||
[Install]
|
||||
WantedBy = multi-user.target
|
||||
|
|
|
@ -1,15 +1,51 @@
|
|||
[Unit]
|
||||
Description = Jellyfin Media Server
|
||||
After = network-online.target
|
||||
Description=Jellyfin is a free software media system that puts you in control of managing and streaming your media.
|
||||
|
||||
[Service]
|
||||
Type = simple
|
||||
EnvironmentFile = /etc/sysconfig/jellyfin
|
||||
WorkingDirectory=/var/lib/jellyfin
|
||||
ExecStart=/usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT}
|
||||
TimeoutSec=15
|
||||
Restart=on-failure
|
||||
User = jellyfin
|
||||
Group = jellyfin
|
||||
WorkingDirectory = /var/lib/jellyfin
|
||||
ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS}
|
||||
Restart = on-failure
|
||||
TimeoutSec = 15
|
||||
SuccessExitStatus=0 143
|
||||
|
||||
NoNewPrivileges=true
|
||||
SystemCallArchitectures=native
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
||||
RestrictNamespaces=false
|
||||
RestrictRealtime=true
|
||||
RestrictSUIDSGID=true
|
||||
ProtectClock=true
|
||||
ProtectControlGroups=false
|
||||
ProtectHostname=true
|
||||
ProtectKernelLogs=false
|
||||
ProtectKernelModules=false
|
||||
ProtectKernelTunables=false
|
||||
LockPersonality=true
|
||||
PrivateTmp=false
|
||||
PrivateDevices=false
|
||||
PrivateUsers=true
|
||||
RemoveIPC=true
|
||||
SystemCallFilter=~@clock
|
||||
SystemCallFilter=~@aio
|
||||
SystemCallFilter=~@chown
|
||||
SystemCallFilter=~@cpu-emulation
|
||||
SystemCallFilter=~@debug
|
||||
SystemCallFilter=~@keyring
|
||||
SystemCallFilter=~@memlock
|
||||
SystemCallFilter=~@module
|
||||
SystemCallFilter=~@mount
|
||||
SystemCallFilter=~@obsolete
|
||||
SystemCallFilter=~@privileged
|
||||
SystemCallFilter=~@raw-io
|
||||
SystemCallFilter=~@reboot
|
||||
SystemCallFilter=~@setuid
|
||||
SystemCallFilter=~@swap
|
||||
SystemCallErrorNumber=EPERM
|
||||
|
||||
[Install]
|
||||
WantedBy = multi-user.target
|
||||
|
|
Loading…
Reference in New Issue
Block a user