nixos/gerrit: Apply more hardening settings (#448870)

2025-10-06 11:13:38 +00:00
parent 54fa5a9a59 8dac7deb3d
commit a2d829eaa7
1 changed files with 3 additions and 1 deletions
@@ -232,10 +232,12 @@ in
        AmbientCapabilities = "";
        CapabilityBoundingSet = "";
        LockPersonality = true;
+        MountAPIVFS = true;
        NoNewPrivileges = true;
        PrivateDevices = true;
        PrivateMounts = true;
        PrivateTmp = true;
+        PrivateUsers = true;
        ProtectClock = true;
        ProtectControlGroups = "strict";
        ProtectHome = true;
@@ -243,7 +245,7 @@ in
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
-        ProtectProc = "noaccess";
+        ProtectProc = "invisible";
        ProtectSystem = "full";
        RestrictAddressFamilies = [
          "AF_UNIX"