From 01a263c29ac63aef0d6bac2afb59213fe400d5db Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Mon, 6 Oct 2025 20:20:48 +0200
Subject: [PATCH] nixos/jenkins: Enable MountAPIVFS hardening in service config

This setting is already implied by others, but add it for completeness
as well. For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#MountAPIVFS=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 .../modules/services/continuous-integration/jenkins/default.nix  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix
index 8b44dfb83335..8ec7c972436b 100644
--- a/nixos/modules/services/continuous-integration/jenkins/default.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/default.nix
@@ -261,6 +261,7 @@ in
         CapabilityBoundingSet = "";
         LockPersonality = true;
         # MemoryDenyWriteExecute = false;   Breaks execution;
+        MountAPIVFS = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;