rebmit/nix-exprs
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

lib/misc: filter resources and privileged syscalls

Browse source
This commit is contained in:
Lu Wang 2024-12-20 19:35:33 +08:00
parent 13d8ed5901
commit 4a958c8029
Signed by: rebmit
SSH key fingerprint: SHA256:3px8QV1zEerIrEWHaqtH5rR9kjetyRST5EipOPrd+bU
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
lib/misc/service-hardened.nix
View file

@ -32,6 +32,11 @@ lib.mapAttrs (_k: lib.mkOptionDefault) {
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallErrorNumber = "EPERM"; SystemCallErrorNumber = "EPERM";
SystemCallFilter = [ "@system-service" ]; SystemCallFilter = [
""
"@system-service"
"~@resources"
"~@privileged"
];
UMask = "0077"; UMask = "0077";
} }