Temporarily disable SystemCallFilter

systemd applies drop-ins in lexicographical order (to be documented by
systemd/systemd#5262), hence the Z- prefix.

Change-Id: I589b9a4fae5cd5dd107f58f734558bfa31517f4b

diff --git a/debian/cacert-gigi-testing.install b/debian/cacert-gigi-testing.install
index c78a9de82e19e3473d722162e16ede1bf9115abb..c9cf96ad7dd78e209c1bbbcc3a00fbe5d8b04260 100644 (file)
--- a/debian/cacert-gigi-testing.install
+++ b/debian/cacert-gigi-testing.install
@@ -1,5 +1,6 @@
 debian/gigi-proxy.service /lib/systemd/system
 debian/gigi-proxy.service.d/SystemCallFilter.conf /lib/systemd/system/gigi-proxy.service.d
+debian/gigi-proxy.service.d/Z-Disable-SystemCallFilter.conf /lib/systemd/system/gigi-proxy.service.d
 debian/gigi-proxy.socket /lib/systemd/system
 debian/gigi-standalone.service /lib/systemd/system
 debian/gigi-simple-signer.service /lib/systemd/system

diff --git a/debian/cacert-gigi.install b/debian/cacert-gigi.install
index c78a9de82e19e3473d722162e16ede1bf9115abb..c9cf96ad7dd78e209c1bbbcc3a00fbe5d8b04260 100644 (file)
--- a/debian/cacert-gigi.install
+++ b/debian/cacert-gigi.install
@@ -1,5 +1,6 @@
 debian/gigi-proxy.service /lib/systemd/system
 debian/gigi-proxy.service.d/SystemCallFilter.conf /lib/systemd/system/gigi-proxy.service.d
+debian/gigi-proxy.service.d/Z-Disable-SystemCallFilter.conf /lib/systemd/system/gigi-proxy.service.d
 debian/gigi-proxy.socket /lib/systemd/system
 debian/gigi-standalone.service /lib/systemd/system
 debian/gigi-simple-signer.service /lib/systemd/system

diff --git a/debian/gigi-proxy.service.d/Z-Disable-SystemCallFilter.conf b/debian/gigi-proxy.service.d/Z-Disable-SystemCallFilter.conf
new file mode 100644 (file)
index 0000000..d0a49a2
--- /dev/null
+++ b/debian/gigi-proxy.service.d/Z-Disable-SystemCallFilter.conf
@@ -0,0 +1,3 @@
+[Service]
+# SystemCallFilter seems to be broken in some setups in Debian Stretch's systemd 232-r14
+SystemCallFilter=