nixos/jenkins: Enable MountAPIVFS hardening in service config

This setting is already implied by others, but add it for completeness as well. For documentation see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#MountAPIVFS= Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 16:08:48 +02:00
parent d62c46fec7
commit 01a263c29a
1 changed files with 1 additions and 0 deletions
@@ -261,6 +261,7 @@ in
        CapabilityBoundingSet = "";
        LockPersonality = true;
        # MemoryDenyWriteExecute = false;   Breaks execution;
+        MountAPIVFS = true;
        NoNewPrivileges = true;
        PrivateDevices = true;
        PrivateMounts = true;