From bd8413e8e1d6b698186c4b8cd428110e71b5b463 Mon Sep 17 00:00:00 2001 From: MidAutumnMoon Date: Tue, 25 Oct 2022 15:41:54 +0800 Subject: [PATCH 1/4] nixos/snowflake-proxy: set proper SystemCallFilter --- nixos/modules/services/networking/snowflake-proxy.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/snowflake-proxy.nix b/nixos/modules/services/networking/snowflake-proxy.nix index 7299db7a53e8..ca015ed9d44b 100644 --- a/nixos/modules/services/networking/snowflake-proxy.nix +++ b/nixos/modules/services/networking/snowflake-proxy.nix @@ -71,7 +71,7 @@ in RestrictNamespaces = true; RestrictRealtime = true; SystemCallArchitectures = "native"; - SystemCallFilter = "~@clock @cpu-emulation @debug @mount @obsolete @reboot @swap @privileged @resources"; + SystemCallFilter = [ "@system-service" "~@privileged" ]; UMask = "0077"; }; }; From ae025da558802211d597191ffcf2a7273c030400 Mon Sep 17 00:00:00 2001 From: MidAutumnMoon Date: Tue, 25 Oct 2022 16:07:04 +0800 Subject: [PATCH 2/4] nixos/dex-oidc: set proper SystemCallFilter --- nixos/modules/services/web-apps/dex.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-apps/dex.nix b/nixos/modules/services/web-apps/dex.nix index a171487d4f24..1dcc6f7a7c5b 100644 --- a/nixos/modules/services/web-apps/dex.nix +++ b/nixos/modules/services/web-apps/dex.nix @@ -58,7 +58,7 @@ in ''; description = lib.mdDoc '' The available options can be found in - [the example configuration](https://github.com/dexidp/dex/blob/v${pkgs.dex.version}/config.yaml.dist). + [the example configuration](https://github.com/dexidp/dex/blob/v${pkgs.dex-oidc.version}/config.yaml.dist). It's also possible to refer to environment variables (defined in [services.dex.environmentFile](#opt-services.dex.environmentFile)) using the syntax `$VARIABLE_NAME`. @@ -119,7 +119,7 @@ in RestrictRealtime = true; RestrictSUIDSGID = true; SystemCallArchitectures = "native"; - SystemCallFilter = [ "@system-service" "~@privileged @resources @setuid @keyring" ]; + SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ]; TemporaryFileSystem = "/:ro"; # Does not work well with the temporary root #UMask = "0066"; From 7742cd543da19a9b7bc32ead0394dfa9ff5c4bd1 Mon Sep 17 00:00:00 2001 From: MidAutumnMoon Date: Tue, 25 Oct 2022 16:09:31 +0800 Subject: [PATCH 3/4] nixos/yggdrasil: set proper SystemCallFilter --- nixos/modules/services/networking/yggdrasil.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix index e56f169d05eb..3d5cbdd2dc3e 100644 --- a/nixos/modules/services/networking/yggdrasil.nix +++ b/nixos/modules/services/networking/yggdrasil.nix @@ -180,7 +180,7 @@ in { RestrictNamespaces = true; RestrictRealtime = true; SystemCallArchitectures = "native"; - SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources"; + SystemCallFilter = [ "@system-service" "~@privileged @keyring" ]; } // (if (cfg.group != null) then { Group = cfg.group; } else {}); From 5c983ac37b52b36c0df06ef390870e7cfdcac5c3 Mon Sep 17 00:00:00 2001 From: MidAutumnMoon Date: Tue, 25 Oct 2022 16:14:24 +0800 Subject: [PATCH 4/4] nixos/prosody-filer: set proper SystemCallFilter --- nixos/modules/services/web-apps/prosody-filer.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-apps/prosody-filer.nix b/nixos/modules/services/web-apps/prosody-filer.nix index 279b4104b0a0..84953546d8e0 100644 --- a/nixos/modules/services/web-apps/prosody-filer.nix +++ b/nixos/modules/services/web-apps/prosody-filer.nix @@ -79,7 +79,7 @@ in { LockPersonality = true; RemoveIPC = true; RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; - SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; + SystemCallFilter = [ "@system-service" "~@privileged" ]; }; }; };