Fix memory deny write execute for nodejs services

2019-04-28 13:15:16 +00:00
parent a089d65d25
commit d9533edad1
4 changed files with 15 additions and 4 deletions
@@ -1,11 +1,22 @@
-{
+let
  defaultHardening = {
      PrivateTmp = "true";
      ProtectSystem = "full";
+      ProtectHome = "true";
      NoNewPrivileges = "true";
      PrivateDevices = "true";
      MemoryDenyWriteExecute = "true";
+      ProtectKernelTunables = "true";
+      ProtectKernelModules = "true";
+      ProtectControlGroups = "true";
+      RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+      LockPersonality = "true";
  };
+in
+{
+  inherit defaultHardening;
+  # node applications apparently rely on memory write execute
+  nodeHardening = defaultHardening // { MemoryDenyWriteExecute = "false"; };
 }