movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 06:00:33 +03:00
Code Activity

nixos/mastodon: remove duplicates SystemCallFilters

Browse source
This commit is contained in:
Izorkin 2021-05-12 11:28:40 +03:00 • committed by Kerstin
parent 943f15d4b7
commit 700ea62f54
1 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nixos/modules/services/web-apps/mastodon.nix
View file

@ -38,7 +38,7 @@ let
// (if cfg.smtp.authenticate then { SMTP_LOGIN = cfg.smtp.user; } else {}) // (if cfg.smtp.authenticate then { SMTP_LOGIN = cfg.smtp.user; } else {})
// cfg.extraConfig; // cfg.extraConfig;
systemCallsList = [ "@clock" "@cpu-emulation" "@debug" "@keyring" "@module" "@mount" "@obsolete" "@raw-io" "@reboot" "@setuid" "@swap" ]; systemCallsList = [ "@cpu-emulation" "@debug" "@keyring" "@mount" "@obsolete" "@privileged" "@setuid" ];
cfgService = { cfgService = {
# User and group # User and group
@ -468,7 +468,7 @@ in {
Type = "oneshot"; Type = "oneshot";
WorkingDirectory = cfg.package; WorkingDirectory = cfg.package;
# System Call Filtering # System Call Filtering
SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ]); SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" ];
} // cfgService; } // cfgService;
after = [ "network.target" ]; after = [ "network.target" ];
@ -495,7 +495,7 @@ in {
EnvironmentFile = "/var/lib/mastodon/.secrets_env"; EnvironmentFile = "/var/lib/mastodon/.secrets_env";
WorkingDirectory = cfg.package; WorkingDirectory = cfg.package;
# System Call Filtering # System Call Filtering
SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ]); SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" ];
} // cfgService; } // cfgService;
after = [ "mastodon-init-dirs.service" "network.target" ] ++ (if databaseActuallyCreateLocally then [ "postgresql.service" ] else []); after = [ "mastodon-init-dirs.service" "network.target" ] ++ (if databaseActuallyCreateLocally then [ "postgresql.service" ] else []);
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
@ -521,7 +521,7 @@ in {
RuntimeDirectory = "mastodon-streaming"; RuntimeDirectory = "mastodon-streaming";
RuntimeDirectoryMode = "0750"; RuntimeDirectoryMode = "0750";
# System Call Filtering # System Call Filtering
SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@privileged" "@resources" ]); SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ]);
} // cfgService; } // cfgService;
}; };
@ -545,7 +545,7 @@ in {
RuntimeDirectory = "mastodon-web"; RuntimeDirectory = "mastodon-web";
RuntimeDirectoryMode = "0750"; RuntimeDirectoryMode = "0750";
# System Call Filtering # System Call Filtering
SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ]); SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" ];
} // cfgService; } // cfgService;
path = with pkgs; [ file imagemagick ffmpeg ]; path = with pkgs; [ file imagemagick ffmpeg ];
}; };
@ -567,7 +567,7 @@ in {
EnvironmentFile = "/var/lib/mastodon/.secrets_env"; EnvironmentFile = "/var/lib/mastodon/.secrets_env";
WorkingDirectory = cfg.package; WorkingDirectory = cfg.package;
# System Call Filtering # System Call Filtering
SystemCallFilter = "~" + lib.concatStringsSep " " systemCallsList; SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" ];
} // cfgService; } // cfgService;
path = with pkgs; [ file imagemagick ffmpeg ]; path = with pkgs; [ file imagemagick ffmpeg ];
}; };