nixos/mastodon: add new sandboxing options

2021-11-06 16:45:20 +01:00
parent e62c9ce932
commit 943f15d4b7
1 changed files with 4 additions and 0 deletions
@@ -50,6 +50,9 @@ let
    # Logs directory and mode
    LogsDirectory = "mastodon";
    LogsDirectoryMode = "0750";
+    # Proc filesystem
+    ProcSubset = "pid";
+    ProtectProc = "invisible";
    # Access write directories
    UMask = "0027";
    # Capabilities
@@ -74,6 +77,7 @@ let
    MemoryDenyWriteExecute = false;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
+    RemoveIPC = true;
    PrivateMounts = true;
    # System Call Filtering
    SystemCallArchitectures = "native";