movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-14 13:39:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/isso: systemd unit hardening

Browse source
This commit is contained in:
Alexandre Iooss 2021-10-07 09:53:31 +02:00
parent cb907c594a
commit 1c659c9958
No known key found for this signature in database
GPG key ID: 6C79278F3FCDCC02
1 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nixos/modules/services/web-apps/isso.nix
View file

@ -63,6 +63,28 @@ in {
Restart = "on-failure";
RestartSec = 1;
# Hardening
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
UMask = "0077";
};
};
};