From 989a81c8d8a11dffa593adf0bb817b0bd9b8b8a5 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Wed, 18 Jul 2018 23:49:16 +0200 Subject: [PATCH] Drop seccomp system call filter for udev The seccomp based system call whitelist requires at least systemd 239 to be the active init and during a dist-upgrade we can't guarantee that systemd has been fully configured before udev is restarted. This partially reverts upstream commit ee8f26180d01e3ddd4e5f20b03b81e5e737657ae. Once buster is released, this patch can be dropped. Closes: #903224 Gbp-Pq: Topic debian Gbp-Pq: Name Drop-seccomp-system-call-filter-for-udev.patch --- units/systemd-udevd.service.in | 2 -- 1 file changed, 2 deletions(-) diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in index 9ada3a6a..f395e832 100644 --- a/units/systemd-udevd.service.in +++ b/units/systemd-udevd.service.in @@ -35,8 +35,6 @@ MemoryDenyWriteExecute=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 RestrictRealtime=yes RestrictSUIDSGID=yes -SystemCallFilter=@system-service @module @raw-io -SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any -- 2.30.2