···

       
896
       
896
       
 
       
        PrivateMounts = true;

     

       
897
       
897
       
 
       
        # System Call Filtering

     

       
898
       
898
       
 
       
        SystemCallArchitectures = "native";

     

       
899
       
899
       
-
       
        SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid";

     

       
899
       
899
       
+
       
        SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid @mincore";

     

       
900
       
900
       
 
       
      };

     

       
901
       
901
       
 
       
    };

     

       
902
       
902