movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-11 12:15:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/clash-verge: harden systemd service; nixos/clash-verge: readd tunMode (#402545)

Browse source
This commit is contained in:
Aleksana 2025-05-24 14:54:33 +08:00 • committed by GitHub
commit 0191ef9253
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 38 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

42
nixos/modules/programs/clash-verge.nix
View file

@ -7,9 +7,6 @@
{
imports = [
(lib.mkRemovedOptionModule [ "programs" "clash-verge" "tunMode" ] ''
The tunMode will work with service mode which is enabled by default.
'')
];
options.programs.clash-verge = {
enable = lib.mkEnableOption "Clash Verge";
@ -23,6 +20,8 @@
default = pkgs.clash-verge-rev;
defaultText = lib.literalExpression "pkgs.clash-verge-rev";
};
serviceMode = lib.mkEnableOption "Service Mode";
tunMode = lib.mkEnableOption "Setcap for TUN Mode. DNS settings won't work on this way";
autoStart = lib.mkEnableOption "Clash Verge auto launch";
};
@ -42,12 +41,47 @@
))
];
systemd.services.clash-verge = {
security.wrappers.clash-verge = lib.mkIf cfg.tunMode {
owner = "root";
group = "root";
capabilities = "cap_net_bind_service,cap_net_raw,cap_net_admin=+ep";
source = "${lib.getExe cfg.package}";
};
systemd.services.clash-verge = lib.mkIf cfg.serviceMode {
enable = true;
description = "Clash Verge Service Mode";
serviceConfig = {
ExecStart = "${cfg.package}/bin/clash-verge-service";
Restart = "on-failure";
ProtectSystem = "strict";
NoNewPrivileges = true;
ProtectHostname = true;
ProtectProc = "invisible";
ProcSubset = "pid";
SystemCallArchitectures = "native";
PrivateTmp = true;
PrivateMounts = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
LockPersonality = true;
RestrictRealtime = true;
ProtectClock = true;
MemoryDenyWriteExecute = true;
RestrictSUIDSGID = true;
RestrictNamespaces = [ "~user cgroup ipc mnt uts" ];
RestrictAddressFamilies = [
"AF_INET AF_INET6 AF_NETLINK AF_PACKET AF_RAW"
];
CapabilityBoundingSet = [
"CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SETUID CAP_SETGID CAP_CHOWN CAP_MKNOD"
];
SystemCallFilter = [
"~@aio @chown @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @pkey @privileged @raw-io @reboot @sandbox @setuid @swap @timer"
];
SystemCallErrorNumber = "EPERM";
};
wantedBy = [ "multi-user.target" ];
};