mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-09-11 15:08:33 +01:00
nixos/nginx: fix SystemCallFilter for openresty
This commit is contained in:
parent
c26e3354a7
commit
30186896ee
|
@ -932,7 +932,7 @@ in
|
|||
# System Call Filtering
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ]
|
||||
++ optionals ((cfg.package != pkgs.tengine) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ];
|
||||
++ optionals ((cfg.package != pkgs.tengine) && (cfg.package != pkgs.openresty) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
Loading…
Reference in a new issue