blacklist /tmp/.X11-unix blacklist ${RUNUSER}/wayland-* include disable-write-mnt.inc whitelist ${HOME}/.moc whitelist ${MUSIC} read-only ${MUSIC} # # alsa audio will work with ipc-namespace, # # but it hogs the alsa device from other applications ignore ipc-namespace machine-id ignore netfilter net none protocol unix disable-mnt private-bin moc,mocp private-etc asound.conf,group,localtime,machine-id