pleb/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

service hardening: add more restrictions

Browse Source 
Add RestrictSUIDSGID
Add RemoveIPC
Add RestrictRealtime
Add ProtectHostname
This commit is contained in:
nixbitcoin
2020-05-24 11:14:45 +00:00
parent 3fbfa98635
commit ccc3a70344
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nix-bitcoin-services.nix
+4
View File
@@ -21,6 +21,10 @@ with lib;
LockPersonality = "true"; LockPersonality = "true";
IPAddressDeny = "any"; IPAddressDeny = "any";
PrivateUsers = "true"; PrivateUsers = "true";
RestrictSUIDSGID = "true";
RemoveIPC = "true";
RestrictRealtime = "true";
ProtectHostname = "true";
CapabilityBoundingSet = ""; CapabilityBoundingSet = "";
# @system-service whitelist and docker seccomp blacklist (except for "clone" # @system-service whitelist and docker seccomp blacklist (except for "clone"
# which is a core requirement for systemd services) # which is a core requirement for systemd services)