fix: allow netlink for wildcard listener startup

2026-09-02 14:06:49 +08:00
parent 37ffc27ff5
commit 1925676fc9
4 changed files with 9 additions and 3 deletions
@@ -15,7 +15,9 @@ Environment=PATH=/usr/sbin:/usr/bin:/sbin:/bin
 NoNewPrivileges=true
 CapabilityBoundingSet=
 AmbientCapabilities=
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+# Keep the updater compatible with the same Node/libuv interface discovery
+# path while retaining an explicit socket-family allowlist.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 PrivateTmp=true
 PrivateDevices=true
 ProtectHome=true
@@ -20,7 +20,9 @@ ProtectSystem=strict
 InaccessiblePaths=/opt/tallynote/.update-work
 ProtectHome=true
 PrivateDevices=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+# Fastify logs the addresses of wildcard listeners. Node's libuv uses the
+# Linux netlink family while enumerating interfaces for that log message.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectKernelLogs=true