bughz/glider
1
0
Fork 0
mirror of https://github.com/nadoo/glider.git synced 2025-02-23 09:25:41 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

systemd: add CAP_NET_ADMIN capability for ipset

Browse Source
This commit is contained in:
nadoo 2017-08-28 23:14:52 +08:00
parent 4729fc57f3
commit 9d9fe7bfd8
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
systemd/glider@.service
View File

@ -11,8 +11,10 @@ Restart=always
ExecStart=/usr/bin/glider -config /etc/glider/%i.conf
# work with systemd v229 or later, so glider can listen on port below 1024 with none-root user
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
# CAP_NET_ADMIN: ipset
# CAP_NET_BIND_SERVICE: bind ports under 1024
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
[Install]