movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-10 19:55:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/postgresql: enable private /tmp & private mounts; fix wal-receiver test

Browse source 
The issue was that the old test-case used `/tmp` to share data. Using
`JoinsNamespaceOf=` wasn't a real workaround since the private `/tmp` is
recreated when a service gets stopped/started which is the case here, so
the wals were still lost.

To keep the test building with `PrivateTmp=yes`, create a dedicated
directory in `/var/cache` with tmpfiles and allow the hardened
`postgresql.service` to access it via `ReadWritePaths`.
This commit is contained in:
Maximilian Bosch 2024-09-30 17:23:10 +02:00 • committed by Martin Weinelt
parent 2ebffcc4c7
commit f800d8e42b
No known key found for this signature in database
GPG key ID: 87C1E9888F856759
2 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nixos/modules/services/databases/postgresql.nix
View file

@ -627,14 +627,14 @@ in
# Hardening
CapabilityBoundingSet = [ "" ];
DevicePolicy = "closed";
PrivateTmp = false; #breaks wal-receiver test
PrivateTmp = true;
ProtectHome = true;
ProtectSystem = "strict";
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
LockPersonality = true;
PrivateDevices = true;
PrivateMounts = false; # breaks wal-receiver test
PrivateMounts = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;