vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-logs-auth: PrivateTmp=disconnected, as DynamicUser implied

Browse source 
DynamicUser implies PrivateTmp=disconnected (systemd.exec(5)), a tmpfs
of the unit's own rather than a private directory reachable from the
host namespace. The explicit setting now matches what the unit ran
with before it moved to a static user.

Refs #5235
This commit is contained in:
atlas 2026-10-14 16:57:45 +02:00 • committed by mara
commit 065933b83e
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/host-modules/swarm-victorialogs.nix
View file

@ -414,7 +414,7 @@ in
SyslogIdentifier = logsAuthUnit; SyslogIdentifier = logsAuthUnit;
ProtectSystem = "strict"; ProtectSystem = "strict";
ProtectHome = true; ProtectHome = true;
PrivateTmp = true; PrivateTmp = "disconnected";
PrivateDevices = true; PrivateDevices = true;
NoNewPrivileges = true; NoNewPrivileges = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;