nixos/tor: harden ProcSubset and ProtectProc

2021-05-10 16:50:41 +02:00
parent acd5e6707e
commit cd1f6bc712
1 changed files with 2 additions and 0 deletions
@@ -1007,6 +1007,7 @@ in
        # Tor cannot currently bind privileged port when PrivateUsers=true,
        # see https://gitlab.torproject.org/legacy/trac/-/issues/20930
        PrivateUsers = !bindsPrivilegedPort;
+        ProcSubset = "pid";
        ProtectClock = true;
        ProtectControlGroups = true;
        ProtectHome = true;
@@ -1014,6 +1015,7 @@ in
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
        ProtectSystem = "strict";
        RemoveIPC = true;
        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];