gador/nix-flake-crowdsec
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable access to local systemd-journal for security engine via module

Browse Source 
options

Closes Github #1
This commit is contained in:
Daniel Czerwonk
2024-03-14 10:59:36 +01:00
committed by Christian Kampka
parent 664c83a43b
commit f14c67e63d
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
modules/crowdsec/default.nix
View File

@@ -127,6 +127,14 @@ in {
type = format.type; type = format.type;
default = {}; default = {};
}; };
allowLocalJournalAccess = mkOption {
description = mkDoc ''
Allow acquisitions from local systemd-journald.
For details, see <https://doc.crowdsec.net/docs/data_sources/journald>.
'';
type = types.bool;
default = false;
};
}; };
config = let config = let
cscli = pkgs.writeScriptBin "cscli" '' cscli = pkgs.writeScriptBin "cscli" ''
@@ -204,7 +212,7 @@ in {
ProtectControlGroups = mkDefault true; ProtectControlGroups = mkDefault true;
ProtectProc = mkDefault "invisible"; ProtectProc = mkDefault "invisible";
ProcSubset = mkDefault "pid"; ProcSubset = mkIf (!cfg.allowLocalJournalAccess) (mkDefault "pid");
RestrictNamespaces = mkDefault true; RestrictNamespaces = mkDefault true;
RestrictRealtime = mkDefault true; RestrictRealtime = mkDefault true;
@@ -253,10 +261,12 @@ in {
"f '${cfg.settings.api.server.online_client.credentials_path}' 0750 ${user} ${group} - -" "f '${cfg.settings.api.server.online_client.credentials_path}' 0750 ${user} ${group} - -"
"f '${cfg.settings.config_paths.index_path}' 0750 ${user} ${group} - -" "f '${cfg.settings.config_paths.index_path}' 0750 ${user} ${group} - -"
]; ];
users.users.${user} = lib.mapAttrs (name: lib.mkDefault) { users.users.${user} = {
description = "Cowdsec service user"; name = lib.mkDefault user;
isSystemUser = true; description = lib.mkDefault "Cowdsec service user";
inherit group; isSystemUser = lib.mkDefault true;
group = lib.mkDefault group;
extraGroups = lib.mkIf cfg.allowLocalJournalAccess ["systemd-journal"];
}; };
users.groups.${group} = lib.mapAttrs (name: lib.mkDefault) {}; users.groups.${group} = lib.mapAttrs (name: lib.mkDefault) {};