commit 4ee53e6544422f9c49a7d7e97d2c7023c9aaee5f · pyrox.dev/nixpkgs

+12
nixos/modules/services/misc/open-webui.nix
···

       120
       120
        
               RestrictRealtime = true;

     

       121
       121
        
               SystemCallArchitectures = "native";

     

       122
       122
        
               UMask = "0077";

     

       123
       123
       +
               CapabilityBoundingSet = "";

     

       124
       124
       +
               RestrictAddressFamilies = [

     

       125
       125
       +
                 "AF_INET"

     

       126
       126
       +
                 "AF_INET6"

     

       127
       127
       +
                 "AF_UNIX"

     

       128
       128
       +
               ];

     

       129
       129
       +
               ProtectClock = true;

     

       130
       130
       +
               ProtectProc = "invisible";

     

       131
       131
       +
               SystemCallFilter = [

     

       132
       132
       +
                 "@system-service"

     

       133
       133
       +
                 "~@privileged"

     

       134
       134
       +
               ];

     

       123
       135
        
             };

     

       124
       136
        
           };

     

       125
       137