nixos/snowflake-proxy: set proper SystemCallFilter

2022-10-25 15:41:54 +08:00 · 2022-10-25 15:41:54 +08:00 · bd8413e8e1
commit bd8413e8e1
parent 8e22463268
1 changed files with 1 additions and 1 deletions
--- a/nixos/modules/services/networking/snowflake-proxy.nix
+++ b/nixos/modules/services/networking/snowflake-proxy.nix
@ -71,7 +71,7 @@ in
        RestrictNamespaces = true;
        RestrictRealtime = true;
        SystemCallArchitectures = "native";
-        SystemCallFilter = "~@clock @cpu-emulation @debug @mount @obsolete @reboot @swap @privileged @resources";
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
        UMask = "0077";
      };
    };