fwupd / fwupd / 8707752120 / 2

53%

main: 53%

push

github

Change SystemCallFilter to allowlist

As per the systemd documentation:

Generally, allow-listing system calls (rather than deny-listing) is the safer
mode of operation. It is recommended to enforce system call allow lists for all
long-running system services.

Verified with no notible changes to `systemd-analyze security fwupd.service`

Many thanks to RZR7332 for the original patch.

17207 of 32156 branches covered (53.51%)

Branch coverage included in aggregate %.

51956 of 112777 relevant lines covered (46.07%)

3762.77 hits per line