movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos/wakapi: harden systemd service

Browse source 
when using `systemd-analyze security wakapi.service` we went from a 5.9
to a 3.
This commit is contained in:
isabel 2025-03-13 15:30:32 +00:00
parent 2b4960c707
commit c7968cf140
No known key found for this signature in database
GPG key ID: 3E7C7A1B5DEDBB03
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nixos/modules/services/web-apps/wakapi.nix
View file

@ -159,18 +159,25 @@ in
Group = config.users.users.wakapi.group; Group = config.users.users.wakapi.group;
DynamicUser = true; DynamicUser = true;
PrivateTmp = true;
PrivateUsers = true;
PrivateDevices = true;
ProtectHome = true; ProtectHome = true;
ProtectHostname = true; ProtectHostname = true;
ProtectClock = true;
ProtectKernelLogs = true; ProtectKernelLogs = true;
ProtectKernelModules = true; ProtectKernelModules = true;
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectControlGroups = true;
NoNewPrivileges = true;
ProtectProc = "invisible"; ProtectProc = "invisible";
ProtectSystem = "strict"; ProtectSystem = "full";
RestrictAddressFamilies = [ RestrictAddressFamilies = [
"AF_INET" "AF_INET"
"AF_INET6" "AF_INET6"
"AF_UNIX" "AF_UNIX"
]; ];
CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
RestrictNamespaces = true; RestrictNamespaces = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;