···

       
256
       
256
       
 
       
        LockPersonality = true;

     

       
257
       
257
       
 
       
        MemoryDenyWriteExecute = true;

     

       
258
       
258
       
 
       


     

       
259
       
259
       
-
       
        ProcSubset = "pid";

     

       
259
       
259
       
+
       
        # Meilisearch needs to determine cgroup memory limits to set its own memory limits.

     

       
260
       
260
       
+
       
        # This means this can't be set to "pid"

     

       
261
       
261
       
+
       
        ProcSubset = "all";

     

       
260
       
262
       
 
       
        ProtectProc = "invisible";

     

       
261
       
263
       
 
       


     

       
262
       
264
       
 
       
        NoNewPrivileges = true;