fix: allow verified in-place updates

This commit is contained in:
MengMengCode
2026-08-09 20:09:44 +08:00
parent 7f162d43ef
commit 79dc2bc934
2 changed files with 5 additions and 3 deletions
+3 -1
View File
@@ -229,7 +229,9 @@ ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
ReadWritePaths=/opt/vocat/data
# The web/CLI self-updater verifies a release in this directory and atomically
# renames it over the running binary. Keep the rest of the host read-only.
ReadWritePaths=/opt/vocat/data /opt/vocat/bin
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictRealtime=true
LockPersonality=true