nixos/meme-bingo-web: harden

2025-02-23 17:47:56 +01:00
parent db6c59929b
commit 4d2bb49e75
1 changed files with 5 additions and 0 deletions
@@ -89,6 +89,9 @@ in
        InaccessiblePaths = [
          "/dev/shm"
          "/sys"
+          "/run/dbus"
+          "/run/user"
+          "/run/nscd"
        ];
        LockPersonality = true;
        PrivateDevices = true;
@@ -124,6 +127,8 @@ in
        RemoveIPC = true;
        NoNewPrivileges = true;
        MemoryDenyWriteExecute = true;
+        ExecPaths = [ "/nix/store" ];
+        NoExecPaths = [ "/" ];
      };
    };
  };