gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #173109 from Mic92/upterm

Browse Source 
nixos/upterm: additional hardening
This commit is contained in:
Jörg Thalheim
2022-05-19 20:16:13 +01:00
committed by GitHub
parent 90344e9f40 14e2c1e4fb
commit e56ae50ed9
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
nixos/modules/services/networking/uptermd.nix
View File

@@ -85,6 +85,7 @@ in
AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
PrivateUsers = cfg.port >= 1024;
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
@@ -95,7 +96,9 @@ in
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
ProtectProc = "invisible";
# AF_UNIX is for ssh-keygen, which relies on nscd to resolve the uid to a user
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";