All modules: ProtectSystem = strict

Add ReadWritePaths in all modules, except lnd which has ProtectSystem = full.
2020-05-22 15:47:01 +00:00
parent adc71b892e
commit a040e52854
10 changed files with 11 additions and 1 deletions
@@ -286,6 +286,7 @@ in {
        ExecStart = "${cfg.package}/bin/bitcoind -datadir='${cfg.dataDir}'";
        Restart = "on-failure";
        UMask = mkIf cfg.dataDirReadableByGroup "0027";
+        ReadWritePaths = "${cfg.dataDir}";
      } // (if cfg.enforceTor
            then nix-bitcoin-services.allowTor
            else nix-bitcoin-services.allowAnyIP)
@@ -317,6 +318,7 @@ in {
      serviceConfig = nix-bitcoin-services.defaultHardening // {
        User = "${cfg.user}";
        Group = "${cfg.group}";
+        ReadWritePaths = "${cfg.dataDir}";
      } // nix-bitcoin-services.allowTor;
    };