movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-14 13:39:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/pocket-id: harden after backend-frontend merge

Browse source
This commit is contained in:
Gutyina Gergő 2025-06-02 01:20:23 +02:00
parent f4249b03a9
commit 259a75fb1f
No known key found for this signature in database
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nixos/modules/services/security/pocket-id.nix
View file

@ -174,12 +174,12 @@ in
CapabilityBoundingSet = ""; CapabilityBoundingSet = "";
DeviceAllow = ""; DeviceAllow = "";
DevicePolicy = "closed"; DevicePolicy = "closed";
#IPAddressDeny = "any"; # communicates with the frontend #IPAddressDeny = "any"; # provides the service through network
LockPersonality = true; LockPersonality = true;
MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateDevices = true; PrivateDevices = true;
PrivateNetwork = false; # communicates with the frontend PrivateNetwork = false; # provides the service through network
PrivateTmp = true; PrivateTmp = true;
PrivateUsers = true; PrivateUsers = true;
ProcSubset = "pid"; ProcSubset = "pid";
@ -191,7 +191,8 @@ in
ProtectKernelModules = true; ProtectKernelModules = true;
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectProc = "invisible"; ProtectProc = "invisible";
ProtectSystem = "full"; # needs to write in cfg.dataDir ProtectSystem = "strict";
ReadWritePaths = [ cfg.dataDir ];
RemoveIPC = true; RemoveIPC = true;
RestrictAddressFamilies = [ RestrictAddressFamilies = [
"AF_INET" "AF_INET"
@ -212,7 +213,7 @@ in
"@privileged" "@privileged"
"@raw-io" "@raw-io"
"@reboot" "@reboot"
#"@resources" # vm test segfaults "@resources"
"@swap" "@swap"
]; ];
UMask = "0077"; UMask = "0077";