fwupd / fwupd / 8707752120

53%

push

github

Change SystemCallFilter to allowlist

As per the systemd documentation:

Generally, allow-listing system calls (rather than deny-listing) is the safer
mode of operation. It is recommended to enforce system call allow lists for all
long-running system services.

Verified with no notible changes to `systemd-analyze security fwupd.service`

Many thanks to RZR7332 for the original patch.

17381 of 32415 branches covered (53.62%)

Branch coverage included in aggregate %.

52024 of 112834 relevant lines covered (46.11%)

7577.5 hits per line