Skip to content

Commit

Permalink
Disable RestrictSUIDGUID so portmaster can fix electron permissions
Browse files Browse the repository at this point in the history
  • Loading branch information
@ppacher
ppacher committed Jan 25, 2022
1 parent ef479e5 commit 19c76c7
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions linux/portmaster.service
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,16 +25,15 @@ ProtectSystem=true
#ReadWritePaths=/run/xtables.lock
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
RestrictNamespaces=yes
RestrictSUIDSGID=yes
# In future version portmaster will require access to user home
# directories to verify application permissions.
ProtectHome=read-only
ProtectKernelTunables=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
PrivateDevices=yes
AmbientCapabilities=cap_chown cap_kill cap_net_admin cap_net_bind_service cap_net_broadcast cap_net_raw cap_sys_module cap_sys_ptrace cap_dac_override
CapabilityBoundingSet=cap_chown cap_kill cap_net_admin cap_net_bind_service cap_net_broadcast cap_net_raw cap_sys_module cap_sys_ptrace cap_dac_override
AmbientCapabilities=cap_chown cap_kill cap_net_admin cap_net_bind_service cap_net_broadcast cap_net_raw cap_sys_module cap_sys_ptrace cap_dac_override cap_fowner cap_fsetid
CapabilityBoundingSet=cap_chown cap_kill cap_net_admin cap_net_bind_service cap_net_broadcast cap_net_raw cap_sys_module cap_sys_ptrace cap_dac_override cap_fowner cap_fsetid
# SystemCallArchitectures=native
# SystemCallFilter=@system-service @module
# SystemCallErrorNumber=EPERM
Expand Down

0 comments on commit 19c76c7

Please sign in to comment.