diff options
| author | cvium <clausvium@gmail.com> | 2022-01-07 10:23:22 +0100 |
|---|---|---|
| committer | cvium <clausvium@gmail.com> | 2022-01-07 10:23:22 +0100 |
| commit | c658a883a2bc84b46ed73d209d2983e8a324cdce (patch) | |
| tree | dabdbb5ac224e202d5433e7062e0c1b6872d1af7 /debian | |
| parent | 2899b77cd58456470b8dd4d01d3a8c525a9b5911 (diff) | |
| parent | 6b4f5a86631e5bde93dae88553380c7ffd99b8e4 (diff) | |
Merge branch 'master' into keyframe_extraction_v1
# Conflicts:
# Jellyfin.Api/Controllers/DynamicHlsController.cs
# MediaBrowser.Controller/MediaEncoding/IMediaEncoder.cs
# MediaBrowser.MediaEncoding/Encoder/MediaEncoder.cs
Diffstat (limited to 'debian')
| -rw-r--r-- | debian/jellyfin.service | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/debian/jellyfin.service b/debian/jellyfin.service index b79cd47c7..b86f40473 100644 --- a/debian/jellyfin.service +++ b/debian/jellyfin.service @@ -10,5 +10,39 @@ ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELL Restart = on-failure TimeoutSec = 15 +NoNewPrivileges=true +SystemCallArchitectures=native +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=true +RestrictRealtime=true +RestrictSUIDSGID=true +ProtectControlGroups=true +ProtectHostname=true +ProtectKernelLogs=true +ProtectKernelModules=true +ProtectKernelTunables=true +LockPersonality=true +PrivateTmp=true +PrivateDevices=false +PrivateUsers=true +RemoveIPC=true +SystemCallFilter=~@clock +SystemCallFilter=~@aio +SystemCallFilter=~@chown +SystemCallFilter=~@cpu-emulation +SystemCallFilter=~@debug +SystemCallFilter=~@keyring +SystemCallFilter=~@memlock +SystemCallFilter=~@module +SystemCallFilter=~@mount +SystemCallFilter=~@obsolete +SystemCallFilter=~@privileged +SystemCallFilter=~@raw-io +SystemCallFilter=~@reboot +SystemCallFilter=~@setuid +SystemCallFilter=~@swap +SystemCallErrorNumber=EPERM + + [Install] WantedBy = multi-user.target |