Compare commits
2 Commits
wip-system
...
dev-sane
Author | SHA1 | Date | |
---|---|---|---|
575341a22b | |||
a9f2f4602a |
@@ -15,8 +15,6 @@ If a change only affects particular applications, they are listed in parentheses
|
|||||||
- misc: Unify build system (!23 & !29, thanks @Jarrah & @vladimir.stoyakin)
|
- misc: Unify build system (!23 & !29, thanks @Jarrah & @vladimir.stoyakin)
|
||||||
- misc: Ensure stable file order during builds (!24, thanks @devrtz)
|
- misc: Ensure stable file order during builds (!24, thanks @devrtz)
|
||||||
- fix: Prevent logging internal LVGL errors to stdout
|
- fix: Prevent logging internal LVGL errors to stdout
|
||||||
- misc: Make scdoc a native dependency to enable cross-compilation (!30, thanks @uninsane)
|
|
||||||
- fix: Use usleep to release CPU when possible (!31, thanks @uninsane)
|
|
||||||
|
|
||||||
## 3.2.0 (2024-06-03)
|
## 3.2.0 (2024-06-03)
|
||||||
|
|
||||||
|
@@ -1,38 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Documentation=https://gitlab.postmarketos.org/postmarketOS/buffybox
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
ExecStart=@bindir@/buffyboard
|
|
||||||
Restart=on-failure
|
|
||||||
|
|
||||||
# Allow access to input devices, framebuffer, tty
|
|
||||||
DevicePolicy=closed
|
|
||||||
DeviceAllow=/dev/uinput rw
|
|
||||||
DeviceAllow=char-fb rw
|
|
||||||
DeviceAllow=char-input rw
|
|
||||||
DeviceAllow=char-tty rw
|
|
||||||
# udev requires some limited networking
|
|
||||||
RestrictAddressFamilies=AF_NETLINK
|
|
||||||
|
|
||||||
# Hardening
|
|
||||||
CapabilityBoundingSet=
|
|
||||||
NoNewPrivileges=true
|
|
||||||
RestrictSUIDSGID=true
|
|
||||||
PrivateMounts=true
|
|
||||||
PrivateTmp=true
|
|
||||||
PrivateUsers=true
|
|
||||||
ProtectClock=true
|
|
||||||
ProtectControlGroups=true
|
|
||||||
ProtectHome=true
|
|
||||||
ProtectHostname=true
|
|
||||||
ProtectKernelLogs=true
|
|
||||||
ProtectKernelModules=true
|
|
||||||
ProtectKernelTunables=true
|
|
||||||
ProtectSystem=strict
|
|
||||||
RemoveIPC=true
|
|
||||||
LockPersonality=true
|
|
||||||
MemoryDenyWriteExecute=true
|
|
||||||
SystemCallArchitectures=native
|
|
||||||
SystemCallFilter=@system-service
|
|
||||||
SystemCallFilter=~@privileged
|
|
||||||
SystemCallFilter=~@resources
|
|
@@ -24,13 +24,3 @@ executable('buffyboard',
|
|||||||
|
|
||||||
install_data('buffyboard.conf', install_dir: get_option('sysconfdir'))
|
install_data('buffyboard.conf', install_dir: get_option('sysconfdir'))
|
||||||
|
|
||||||
|
|
||||||
configure_file(
|
|
||||||
input : 'buffyboard.service.in',
|
|
||||||
output : 'buffyboard.service',
|
|
||||||
install : true,
|
|
||||||
install_dir : get_option('libdir') / 'systemd/system',
|
|
||||||
configuration : {
|
|
||||||
'bindir' : get_option('prefix') / get_option('bindir'),
|
|
||||||
},
|
|
||||||
)
|
|
||||||
|
Reference in New Issue
Block a user