|  |  | @ -24,8 +24,8 @@ Group=airsonic | 
			
		
	
		
		
			
				
					
					|  |  |  | # See https://www.freedesktop.org/software/systemd/man/systemd.exec.html |  |  |  | # See https://www.freedesktop.org/software/systemd/man/systemd.exec.html | 
			
		
	
		
		
			
				
					
					|  |  |  | # for details |  |  |  | # for details | 
			
		
	
		
		
			
				
					
					|  |  |  | DevicePolicy=closed |  |  |  | DevicePolicy=closed | 
			
		
	
		
		
			
				
					
					|  |  |  |  |  |  |  | DeviceAllow=char-alsa rw | 
			
		
	
		
		
			
				
					
					|  |  |  | NoNewPrivileges=yes |  |  |  | NoNewPrivileges=yes | 
			
		
	
		
		
			
				
					
					|  |  |  | PrivateDevices=yes |  |  |  |  | 
			
		
	
		
		
			
				
					
					|  |  |  | PrivateTmp=yes |  |  |  | PrivateTmp=yes | 
			
		
	
		
		
			
				
					
					|  |  |  | PrivateUsers=yes |  |  |  | PrivateUsers=yes | 
			
		
	
		
		
			
				
					
					|  |  |  | ProtectControlGroups=yes |  |  |  | ProtectControlGroups=yes | 
			
		
	
	
		
		
			
				
					|  |  | @ -37,6 +37,10 @@ RestrictRealtime=yes | 
			
		
	
		
		
			
				
					
					|  |  |  | SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap |  |  |  | SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap | 
			
		
	
		
		
			
				
					
					|  |  |  | ReadWritePaths=/var/airsonic |  |  |  | ReadWritePaths=/var/airsonic | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  | 
 | 
			
		
	
		
		
			
				
					
					|  |  |  |  |  |  |  | # You can uncomment the following line if you're not using the jukebox | 
			
		
	
		
		
			
				
					
					|  |  |  |  |  |  |  | # This will prevent airsonic from accessing any real (physical) devices | 
			
		
	
		
		
			
				
					
					|  |  |  |  |  |  |  | #PrivateDevices=yes | 
			
		
	
		
		
			
				
					
					|  |  |  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					
					|  |  |  | # You can change the following line to `strict` instead of `full` |  |  |  | # You can change the following line to `strict` instead of `full` | 
			
		
	
		
		
			
				
					
					|  |  |  | # if you don't want airsonic to be able to |  |  |  | # if you don't want airsonic to be able to | 
			
		
	
		
		
			
				
					
					|  |  |  | # write anything on your filesystem outside of AIRSONIC_HOME. |  |  |  | # write anything on your filesystem outside of AIRSONIC_HOME. | 
			
		
	
	
		
		
			
				
					|  |  | 
 |