ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-09-21 04:28:40 +03:00
Code Issues Projects Releases Wiki Activity

nixos/acme: Relax syscall filter after go upgrade

Browse Source 
With Go 1.19 calls to setrlimit are required for lego to run.

While we could allow setrlimit alone, I think it is not unreasonable to
allow @resources in general.

Closes: #197513
This commit is contained in:
Martin Weinelt 2022-10-24 14:57:25 +02:00 committed by zowoq
parent 8753025d8e
commit fcf2d05d81
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/modules/security/acme/default.nix
View File

@ -62,9 +62,9 @@ let
SystemCallArchitectures = "native";
SystemCallFilter = [
# 1. allow a reasonable set of syscalls
"@system-service"
"@system-service @resources"
# 2. and deny unreasonable ones
"~@privileged @resources"
"~@privileged"
# 3. then allow the required subset within denied groups
"@chown"
];