Skip to content
Unverified Commit c106dbd0 authored by tugy's avatar tugy Committed by GitHub
Browse files

add missing syscalls for workers (#2212) 



# Description

Since the binary split additional syscalls are getting blocked in
relation to the workers.

With the hardened systemd file it shows the following warning:

```
Cannot fully enable landlock, a Linux kernel security feature. Running validation of malicious PVF code has a higher risk of compromising this machine. Consider upgrading the kernel version for maximum security. status=Ok(NotEnforced) abi=1
```

For it to work we need to allow additionally:
- mount
- umount2
- pivot_root

and set `RestrictNamespaces=false`

Added new line `SystemCallFilter=pivot_root` because otherwise it would
get blocked by ~\@\privileged

Co-authored-by: default avatars0me0ne-unkn0wn <[email protected]>
Co-authored-by: default avatarBastian Köcher <[email protected]>
parent 6a0859eb
Pipeline #460020 failed with stages
in 1 hour, 23 minutes, and 3 seconds