fix(contrib): support libblas in systemd sandbox (#6190)

Navidrome calls out to ffprobe, which in turn may use libblas on some setups (e.g., Debian 13). The previous syscall filter excluded the "mbind" syscall (via @resources). Through direct experimentation, mbind is required by libblas, and so it is added to the allowed syscall list. Signed-off-by: Antonio Enrico Russo <aerusso@aerusso.net>
2026-10-19 08:54:02 +00:00 · 2026-09-21 07:06:12 -06:00 · 2026-09-21 07:06:12 -06:00 · 00bb120288
commit 00bb120288
parent 6b3938b5b6
1 changed files with 1 additions and 1 deletions
--- a/contrib/navidrome.service
+++ b/contrib/navidrome.service
@ -36,7 +36,7 @@ RestrictNamespaces=yes
 RestrictRealtime=yes
 SystemCallFilter=@system-service
 SystemCallFilter=~@privileged @resources
-SystemCallFilter=setrlimit
+SystemCallFilter=setrlimit mbind
 SystemCallArchitectures=native
 UMask=0066