feat(node): configure system environment through the desktop workflow

2026-09-05 19:46:52 +03:00
parent 15bb793e5e
commit 59e14c5bc0
29 changed files with 929 additions and 81 deletions
@@ -23,9 +23,8 @@ ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectControlGroups=yes
 RestrictSUIDSGID=yes
-# Go reads interface/address inventory through route netlink on Linux.
-# CAP_NET_ADMIN stays absent; this does not grant network reconfiguration.
-RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
+# The explicit environment workflow admits read-only route netlink metadata.
+RestrictAddressFamilies=AF_UNIX AF_INET
 CapabilityBoundingSet=
 LockPersonality=yes
 LimitNOFILE=1024