From 856030d5f9b675591bf5cc12a653646ed1aa3c17 Mon Sep 17 00:00:00 2001 From: Robert Sprunk Date: Wed, 13 Nov 2019 17:04:13 +0100 Subject: [PATCH 1/2] Allow access to real alsa hardware by systemd Signed-off-by: Robert Sprunk --- contrib/airsonic.service | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/contrib/airsonic.service b/contrib/airsonic.service index 1e95ecf9..5cb0995d 100644 --- a/contrib/airsonic.service +++ b/contrib/airsonic.service @@ -24,8 +24,9 @@ Group=airsonic # See https://www.freedesktop.org/software/systemd/man/systemd.exec.html # for details DevicePolicy=closed +DeviceAllow=char-alsa rw NoNewPrivileges=yes -PrivateDevices=yes +#PrivateDevices=yes PrivateTmp=yes PrivateUsers=yes ProtectControlGroups=yes From d063688422cb84a8e3b6997769068fc74eab87ad Mon Sep 17 00:00:00 2001 From: Robert Sprunk Date: Mon, 9 Dec 2019 14:28:19 +0100 Subject: [PATCH 2/2] Move PrivateDevices to a separate section and add a comment Signed-off-by: Robert Sprunk --- contrib/airsonic.service | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/contrib/airsonic.service b/contrib/airsonic.service index 5cb0995d..13617ffa 100644 --- a/contrib/airsonic.service +++ b/contrib/airsonic.service @@ -26,7 +26,6 @@ Group=airsonic DevicePolicy=closed DeviceAllow=char-alsa rw NoNewPrivileges=yes -#PrivateDevices=yes PrivateTmp=yes PrivateUsers=yes ProtectControlGroups=yes @@ -38,6 +37,10 @@ RestrictRealtime=yes SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap ReadWritePaths=/var/airsonic +# You can uncomment the following line if you're not using the jukebox +# This will prevent airsonic from accessing any real (physical) devices +#PrivateDevices=yes + # You can change the following line to `strict` instead of `full` # if you don't want airsonic to be able to # write anything on your filesystem outside of AIRSONIC_HOME.