remove NoNewPrivileges from systemd agent service

configuration (#1203) Prevents service from running `intel_gpu_top`
2025-12-16 02:06:17 +01:00 · 2025-09-25 15:06:17 -04:00
parent 4b43d68da6
commit d83865cb4f
2 changed files with 0 additions and 4 deletions
--- a/supplemental/debian/beszel-agent.service
+++ b/supplemental/debian/beszel-agent.service
@@ -15,8 +15,6 @@ StateDirectory=beszel-agent
 # Security/sandboxing settings
 KeyringMode=private
 LockPersonality=yes
-NoNewPrivileges=yes
-PrivateTmp=yes
 ProtectClock=yes
 ProtectHome=read-only
 ProtectHostname=yes
@@ -24,7 +22,6 @@ ProtectKernelLogs=yes
 ProtectSystem=strict
 RemoveIPC=yes
 RestrictSUIDSGID=true
-SystemCallArchitectures=native

 [Install]
 WantedBy=multi-user.target
--- a/supplemental/scripts/install-agent.sh
+++ b/supplemental/scripts/install-agent.sh
@@ -920,7 +920,6 @@ StateDirectory=beszel-agent
 # Security/sandboxing settings
 KeyringMode=private
 LockPersonality=yes
-NoNewPrivileges=yes
 ProtectClock=yes
 ProtectHome=read-only
 ProtectHostname=yes