gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/nginx: disable MemoryDenyWriteExecute for pkgs.openresty

Browse Source 
fix #140655

Co-authored-by: Yurii Izorkin <izorkin@elven.pw>
This commit is contained in:
Bruno Bigras
2021-10-12 16:26:39 -04:00
parent 726930e9c4
commit 2ceae2db61
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/services/web-servers/nginx/default.nix
View File

@@ -889,7 +889,7 @@ in
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules);
MemoryDenyWriteExecute = !((builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules) || (cfg.package == pkgs.openresty));
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;