ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2025-01-01 16:34:15 +03:00
Code Issues Projects Releases Wiki Activity

nixos/unit: update sandboxing mode

Browse Source
This commit is contained in:
Izorkin 2020-04-14 16:07:30 +03:00
parent 91a7f33b64
commit 3eb6012b64
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
nixos/modules/services/web-servers/unit/default.nix
View File

@ -113,23 +113,30 @@ in {
Group = cfg.group; Group = cfg.group;
# Capabilities # Capabilities
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SETGID" "CAP_SETUID" ]; AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SETGID" "CAP_SETUID" ];
# Runtime directory and mode
RuntimeDirectory = "unit";
RuntimeDirectoryMode = "0750";
# Access write directories
ReadWritePaths = [ cfg.stateDir cfg.logDir ];
# Security # Security
NoNewPrivileges = true; NoNewPrivileges = true;
# Sandboxing # Sandboxing
ProtectSystem = "full"; ProtectSystem = "strict";
ProtectHome = true; ProtectHome = true;
RuntimeDirectory = "unit";
RuntimeDirectoryMode = "0750";
PrivateTmp = true; PrivateTmp = true;
PrivateDevices = true; PrivateDevices = true;
ProtectHostname = true; ProtectHostname = true;
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectKernelModules = true; ProtectKernelModules = true;
ProtectControlGroups = true; ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
LockPersonality = true; LockPersonality = true;
MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true;
PrivateMounts = true; PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";
}; };
}; };