Merge pull request #2697 from iskunk/new-3

Add syscall filtering to xrdp systemd unit
neutrinolabs · Jul 31, 2023 · 1d69970 · 1d69970
2 parents 463cd8a + 9bf78e4
commit 1d69970
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/instfiles/xrdp.service.in b/instfiles/xrdp.service.in
@@ -9,6 +9,8 @@ Type=exec
 EnvironmentFile=-@sysconfdir@/sysconfig/xrdp
 EnvironmentFile=-@sysconfdir@/default/xrdp
 ExecStart=@sbindir@/xrdp $XRDP_OPTIONS --nodaemon
+SystemCallArchitectures=native
+SystemCallFilter=@basic-io @file-system @io-event @ipc @network-io @process @signal ioctl madvise sysinfo uname
 
 [Install]
 WantedBy=multi-user.target