rebmit/nix-exprs
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

lib/misc: add umask to serviceHardened

Browse source
This commit is contained in:
Lu Wang 2024-12-20 16:36:02 +08:00
parent 898ce2046d
commit 13d8ed5901
Signed by: rebmit
SSH key fingerprint: SHA256:3px8QV1zEerIrEWHaqtH5rR9kjetyRST5EipOPrd+bU
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
lib/misc/service-hardened.nix
View file

@ -33,4 +33,5 @@ lib.mapAttrs (_k: lib.mkOptionDefault) {
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallErrorNumber = "EPERM"; SystemCallErrorNumber = "EPERM";
SystemCallFilter = [ "@system-service" ]; SystemCallFilter = [ "@system-service" ];
UMask = "0077";
} }