service hardening: Add CapabilityBoundingSets

Whitelist with exceptions in webindex and onion-chef
2020-05-22 11:29:54 +00:00
parent 3cd61506e0
commit 81a1c3f908
3 changed files with 3 additions and 0 deletions
@@ -89,6 +89,7 @@ in {
        Restart = "on-failure";
        RestartSec = "10s";
        PrivateNetwork = "true"; # This service needs no network access
+        CapabilityBoundingSet = "CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_SYS_ADMIN CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER";
      } // (if cfg.enforceTor
          then nix-bitcoin-services.allowTor
          else nix-bitcoin-services.allowAnyIP