mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-07-09 12:05:50 +03:00
Merge pull request #173109 from Mic92/upterm
nixos/upterm: additional hardening
This commit is contained in:
commit
e56ae50ed9
2 changed files with 9 additions and 3 deletions
|
@ -85,6 +85,7 @@ in
|
|||
AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
|
||||
CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
|
||||
PrivateUsers = cfg.port >= 1024;
|
||||
DynamicUser = true;
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
PrivateDevices = true;
|
||||
|
@ -95,7 +96,9 @@ in
|
|||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
ProtectProc = "invisible";
|
||||
# AF_UNIX is for ssh-keygen, which relies on nscd to resolve the uid to a user
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
SystemCallArchitectures = "native";
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue