nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-01 15:11:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/dnscrypt-proxy: more fs isolation for the updater

Browse Source 
It'd be better to do the update as an unprivileged user; for
now, we do our best to minimize the surface available.  We
filter mount syscalls to prevent the process from undoing the fs
isolation.
This commit is contained in:
Joachim Fasting 2017-03-08 00:42:20 +01:00
parent e72aaa73ea
commit 5f27abec23
No known key found for this signature in database
GPG Key ID: 7544761007FE4E08
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/modules/services/networking/dnscrypt-proxy.nix
View File

@ -285,7 +285,9 @@ in
PrivateTmp = true;
PrivateDevices = true;
ProtectHome = true;
ProtectSystem = true;
ProtectSystem = "strict";
ReadWritePaths = "${dirOf stateDirectory} ${stateDirectory}";
SystemCallFilter = "~@mount";
};
};