From f6f814e69b1c687aa4d6b6c04744418ca4d409ce Mon Sep 17 00:00:00 2001
From: Alexandre Aubin <alex.aubin@mailoo.org>
Date: Wed, 19 Jan 2022 19:40:39 +0100
Subject: [PATCH] Update systemd.service

---
 conf/systemd.service | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/conf/systemd.service b/conf/systemd.service
index 31e9da3..13d2588 100644
--- a/conf/systemd.service
+++ b/conf/systemd.service
@@ -22,12 +22,17 @@ RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictNamespaces=yes
 RestrictRealtime=yes
 DevicePolicy=closed
+ProtectClock=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectProc=invisible
 ProtectSystem=full
 ProtectControlGroups=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
 LockPersonality=yes
-SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
 
 # Denying access to capabilities that should not be relevant for webapps
 # Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html