Merge tag 'v0.19.20'

release v0.19.20
2016-12-09 20:18:54 +01:00
parent 5013de6770 fef45d469c
commit ae7e25ea65
4 changed files with 18 additions and 5 deletions
--- a/systemd/mpd.service.in
+++ b/systemd/mpd.service.in
@@ -14,6 +14,15 @@ LimitRTTIME=infinity
 # disallow writing to /usr, /bin, /sbin, ...
 ProtectSystem=yes

+# more paranoid security settings
+NoNewPrivileges=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+RestrictNamespaces=yes
+
 [Install]
 WantedBy=multi-user.target
 Also=mpd.socket