nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-28 18:03:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

cjdns service: allow daemon to drop privileges

Browse Source 
The service can run certain components with reduced privileges, but for
that it needs the setuid capability.
This commit is contained in:
Joachim Fasting 2017-02-05 04:46:58 +01:00
parent a0338afe5f
commit 2628597e76
No known key found for this signature in database
GPG Key ID: 7544761007FE4E08
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/modules/services/networking/cjdns.nix
View File

@ -258,8 +258,7 @@ in
Restart = "always"; Restart = "always";
StartLimitInterval = 0; StartLimitInterval = 0;
RestartSec = 1; RestartSec = 1;
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW"; CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID";
AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
ProtectSystem = true; ProtectSystem = true;
MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;
ProtectHome = true; ProtectHome = true;