movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 06:00:33 +03:00
Code Activity

nixos/ntpd: Add hardening

Browse source
This commit is contained in:
Pyrox 2024-10-19 14:26:17 -04:00
parent 53bc9450bc
commit 4e632e9c3f
No known key found for this signature in database
GPG key ID: 8CDF3F7CAA53A0F5
1 changed files with 26 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
nixos/modules/services/networking/ntp/ntpd.nix
View file

@ -156,6 +156,32 @@ in
ExecStart = "@${ntp}/bin/ntpd ntpd -g ${builtins.toString ntpFlags}";
Type = "forking";
StateDirectory = "ntp";
# Hardening options
PrivateDevices = true;
PrivateIPC = true;
PrivateTmp = true;
ProtectClock = false;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = true;
RestrictNamespaces = true;
RestrictRealtime = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
AmbientCapabilities = [
"CAP_SYS_TIME"
];
ProtectControlGroups = true;
ProtectProc = "invisible";
ProcSubset = "pid";
RestrictSUIDSGID = true;
};
};