Addd sandboxing exception for `/run/netdata`. (#9613)
This marks `/run/netdata` as writable in our systemd unit files so that users who are listening on a UNIX socket in the 'standard' location can do so witout the sandboxing getting in their way.
Austin S. Hemmelgarn committed
Jul 27, 2020 at 09:14 UTC
92b7d6fe9af95edf7d082a3c49e514b62d9acd13
1 file changed
+2
system/netdata.service.in
+2
@@ -61,6 +61,8 @@ ProtectHome=read-only
61
#PrivateTmp=true
62
ProtectControlGroups=true
63
PrivateMounts=true
64
+# We whitelist this because it's the standard location to listen on a UNIX socket.
65
+ReadWriteDirectories=/run/netdata
66
67
[Install]
68
WantedBy=multi-user.target