chengcheng
024f9267a9
The published service disables the Chromium sandbox and does not perform system administration operations, so the broad capability is unnecessary. Drop all capabilities, prevent privilege escalation, and use the runtime default seccomp profile.