NixOS/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-11 02:15:21 +09:00
Code Activity

nixos/pocket-id: harden after backend-frontend merge

Browse source
This commit is contained in:
Gutyina Gergő 2025-06-02 01:20:23 +02:00
parent f4249b03a9
commit 259a75fb1f
No known key found for this signature in database
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nixos/modules/services/security/pocket-id.nix
View file

@ -174,12 +174,12 @@ in
CapabilityBoundingSet = "";
DeviceAllow = "";
DevicePolicy = "closed";
#IPAddressDeny = "any"; # communicates with the frontend
#IPAddressDeny = "any"; # provides the service through network
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateNetwork = false; # communicates with the frontend
PrivateNetwork = false; # provides the service through network
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
@ -191,7 +191,8 @@ in
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full"; # needs to write in cfg.dataDir
ProtectSystem = "strict";
ReadWritePaths = [ cfg.dataDir ];
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
@ -212,7 +213,7 @@ in
"@privileged"
"@raw-io"
"@reboot"
#"@resources" # vm test segfaults
"@resources"
"@swap"
];
UMask = "0077";