From f4342c11e5feee7dd805045ed4dd3fb069d5ac83 Mon Sep 17 00:00:00 2001 From: MidAutumnMoon Date: Tue, 25 Oct 2022 16:45:49 +0800 Subject: [PATCH 1/4] nixos/geoipupdate: set proper SystemCallFilter --- nixos/modules/services/misc/geoipupdate.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/misc/geoipupdate.nix b/nixos/modules/services/misc/geoipupdate.nix index fafe4e3f2419..ad80d4892435 100644 --- a/nixos/modules/services/misc/geoipupdate.nix +++ b/nixos/modules/services/misc/geoipupdate.nix @@ -197,7 +197,7 @@ in ProtectKernelTunables = true; ProtectProc = "invisible"; ProcSubset = "pid"; - SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; + SystemCallFilter = [ "@system-service" "~@privileged" ]; RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; RestrictRealtime = true; RestrictNamespaces = true; From afb8d0e5a62c6018c4cd3545c76e672cec6ccabb Mon Sep 17 00:00:00 2001 From: MidAutumnMoon Date: Tue, 25 Oct 2022 16:47:09 +0800 Subject: [PATCH 2/4] nixos/prometheus-smartctl: set proper SystemCallFilter --- .../services/monitoring/prometheus/exporters/smartctl.nix | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix index 8906c25d5037..7348c6e9b0b4 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix @@ -66,10 +66,7 @@ in { ProtectProc = "invisible"; ProcSubset = "pid"; SupplementaryGroups = [ "disk" ]; - SystemCallFilter = [ - "@system-service" - "~@privileged @resources" - ]; + SystemCallFilter = [ "@system-service" "~@privileged" ]; }; }; } From 9b8fd74d68fca9eace442379fc74b80bbab894c1 Mon Sep 17 00:00:00 2001 From: MidAutumnMoon Date: Tue, 25 Oct 2022 16:47:46 +0800 Subject: [PATCH 3/4] nixos/nats: set proper SystemCallFilter --- nixos/modules/services/networking/nats.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/nats.nix b/nixos/modules/services/networking/nats.nix index dd732d2a9fca..6c21e21b5cb8 100644 --- a/nixos/modules/services/networking/nats.nix +++ b/nixos/modules/services/networking/nats.nix @@ -137,7 +137,7 @@ in { RestrictNamespaces = true; RestrictRealtime = true; RestrictSUIDSGID = true; - SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; + SystemCallFilter = [ "@system-service" "~@privileged" ]; UMask = "0077"; } ]; From 6724d2221a98815eda9cdc4142ccec144be64b92 Mon Sep 17 00:00:00 2001 From: MidAutumnMoon Date: Tue, 25 Oct 2022 16:48:01 +0800 Subject: [PATCH 4/4] nixos/shiori: set proper SystemCallFilter --- nixos/modules/services/web-apps/shiori.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-apps/shiori.nix b/nixos/modules/services/web-apps/shiori.nix index 7bd0a4d2b9b5..f0505e052e1c 100644 --- a/nixos/modules/services/web-apps/shiori.nix +++ b/nixos/modules/services/web-apps/shiori.nix @@ -86,7 +86,7 @@ in { SystemCallErrorNumber = "EPERM"; SystemCallFilter = [ "@system-service" - "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@resources" "~@setuid" + "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid" ]; }; };